Skip to content
Fencer Intel
medium —

GHSA-v33j-v3x4-42qg json

Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

published last yr. modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Given this Hurl file:

regex.hurl:

``` GET https://foo.com HTTP 200 [Asserts] jsonpath "$.body" matches /<img src="" onerror="alert('Hi!')">/ ```

When exported to HTML:

``` $ hurlfmt --out html regex.hurl <pre><code class="language-hurl"><span class="hurl-entry"><span class="request"><span class="line"><span class="method">GET</span> <span class="url">https://foo.com</span></span> </span><span class="response"><span class="line"><span class="version">HTTP</span> <span class="number">200</span></span> <span class="line"><span class="section-header">[Asserts]</span></span> <span class="line"><span class="query-type">jsonpath</span> <span class="string">"$.body"</span> <span class="predicate-type">matches</span> <span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span> </span></span><span class="line"></span> </code></pre> ```

The regex literal `/<img src="" onerror="alert('Hi!')">/` is not escaped:

`<span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span>`

When opened in a browser, the code is run without user interaction:

![regex](https://github.com/user-attachments/assets/9c20a2ff-900f-4420-b38b-1e7648749119)

Patch / fix

  • crates.io hurl 7.0.0

Is GHSA-v33j-v3x4-42qg in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io hurl
<7.0.0
7.0.0

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.