800+ IT
News
als RSS Feed abonnieren📚 GitLab: RCE via unsafe inline Kramdown options when rendering certain Wiki pages
💡 Newskategorie: Sicherheitslücken
🔗 Quelle: vulners.com
Summary When rendering wiki content with certain extensions such as .rmd, render_wiki_content will call other_markup_unsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and pushing the changes back. Since kramdown is loaded, this will end up using it for the markdown parser by calling Kramdown::Document.new(content).to_html Kramdown has a special extension that allows for options to be set inline, the example they give is: {::options auto_ids="false" footnote_nr="5" syntax_highlighter_opts="{line_numbers: true\}" /} The default syntax highlighter is rouge which has an option formatter that can be set via syntax_highlighter_opts in the inline options. This option gets used by formatter_class: ```ruby def self.call(converter, text, lang, type, call_opts) opts = options(converter, type) call_opts[:default_lang] = opts[:default_lang] return nil unless lang || opts[:default_lang] || opts[:guess_lang] lexer = ::Rouge::Lexer.find_fancy(lang || opts[:default_lang], text) return nil if opts[:disable] || !lexer || (lexer.tag == "plaintext" && !opts[:guess_lang]) opts[:css_class] ||= 'highlight' # For backward compatibility when using Rouge 2.0 formatter = formatter_class(opts).new(opts) formatter.format(lexer.lex(text)) end def self.formatter_class(opts = {}) puts "formatter" puts opts[:formatter] case... ...