René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Critical][ssr] bq-text on raw-text elements (textarea/title) is not escaped → stored XSS in default renderer","articleBody":"## Severity: 🔴 Critical (verified)\n\n## Location\n[`src/ssr/renderer.ts:195-197`](../blob/main/src/ssr/renderer.ts#L195-L197) (`setText`) and [`:418`](../blob/main/src/ssr/renderer.ts#L418) (`bq-text` handler), interacting with [`src/ssr/html-parser.ts:358-362`](../blob/main/src/ssr/html-parser.ts#L358-L362) (`serializeTree` raw-element branch). This is the **default backend** on all server runtimes without a global `DOMParser` (Node/Bun/Deno — see [`src/ssr/config.ts`](../blob/main/src/ssr/config.ts)).\n\n## Description\n`setText` writes the evaluated value directly as a text child with **no escaping**:\n```ts\nconst setText = (el: SSRElement, value: string): void =\u003e {\n  el.children = [{ type: 'text', value }];\n};\n```\nFor raw-text elements (`script`, `style`, `textarea`, `title` — see `html-parser.ts:34`), `serializeTree` emits text children **verbatim, without escaping**:\n```ts\nif (el.raw) {\n  for (const child of el.children) {\n    if (child.type === 'text') inner += child.value;   // no escaping\n  }\n}\n```\nSo an untrusted `bq-text` value on a `\u003ctextarea\u003e` or `\u003ctitle\u003e` can close the element and inject live markup. The author was aware of exactly this hazard for `bq-model` — [`renderer.ts:234-238`](../blob/main/src/ssr/renderer.ts#L234-L238) escapes via `el.raw ? escapeText(...)` with a comment naming the XSS — but the identical protection is **missing** on the `bq-text` path (`renderer.ts:418` calls `setText(el, String(value ?? ''))`).\n\n## Reproduction (executed)\n```\nInput:  \u003ctextarea bq-text=\"msg\"\u003e\u003c/textarea\u003e   msg = '\u003c/textarea\u003e\u003cimg src=x onerror=alert(1)\u003e'\nOutput: \u003ctextarea bq-text=\"msg\"\u003e\u003c/textarea\u003e\u003cimg src=x onerror=alert(1)\u003e\u003c/textarea\u003e\n\nInput:  \u003ctitle bq-text=\"msg\"\u003e\u003c/title\u003e          msg = '\u003c/title\u003e\u003cscript\u003ealert(1)\u003c/script\u003e'\nOutput: \u003ctitle bq-text=\"msg\"\u003e\u003c/title\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003c/title\u003e\n```\nThe browser closes the `textarea`/`title` at the injected close tag, then executes the following `\u003cimg onerror\u003e` / `\u003cscript\u003e`. `bq-text` on a `\u003ctextarea\u003e`/`\u003ctitle\u003e` is a completely ordinary pattern requiring no developer misuse, and the value is exactly where untrusted data normally flows. (The legacy DOM-backed path in `render.ts`, which uses `textContent` + `escapeHtmlText`, is not affected — only the default pure renderer.)\n\n## Suggested fix\nEscape when the target is a raw-text element, mirroring the existing `bq-model` handling:\n```ts\nconst setText = (el: SSRElement, value: string): void =\u003e {\n  el.children = [{ type: 'text', value: el.raw ? escapeText(value) : value }];\n};\n```\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:02:30.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/163/bQuery/issues/163"}