mirror of
https://github.com/karakeep-app/karakeep.git
synced 2026-10-26 09:15:12 +01:00
Mohamed BassemandClaude Opus 5
f0381b4277
Tag names were concatenated straight into the TAGS="..." attribute of the exported HTML with no escaping, while the URL and title on the same line were both escaped. A tag containing a quote breaks out of the attribute, and one containing `">` breaks out of the <A> element entirely. Tag names are attacker-influenced: the AI tagger writes them from raw model output, which is parsed as z.array(z.string()) with no character validation, so a crawled page can steer the tagger into emitting a payload. The export is served as text/html, so the script runs when the user opens the downloaded file. The vector is also reachable cross-user, since a crafted netscape import plants tags that the victim later re-exports. Escape the joined tag names with the existing helper, and cover it with a test. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1xMm8rJm4riqQgyy9Eydu