René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[High][view] bq-bind writes unsanitized values to URL/event-handler/srcdoc attributes (DOM-XSS)","articleBody":"## Severity: 🟠 High\n\n## Location\n- Client: [`src/view/directives/bind.ts:9-23`](../blob/main/src/view/directives/bind.ts#L9-L23) (sink at `:18`)\n- SSR: [`src/ssr/renderer.ts:470-517`](../blob/main/src/ssr/renderer.ts#L470-L517) / [`src/ssr/render.ts`](../blob/main/src/ssr/render.ts) (`srcdoc` variant)\n\n## Description\n`handleBind` writes any attribute directly from runtime data with **no protocol or attribute-name validation**:\n```ts\nel.setAttribute(attrName, String(value));\n```\nThe attribute *name* is template-controlled (trusted), but the *value* is runtime data — exactly the class the framework tells authors is safe to bind. This is inconsistent with `bq-html`, where `sanitizeHtml` blocks `javascript:` in `href`/`src`/`action`. `bq-bind` — the most common way to bind data to an attribute — has none of that.\n\nConcrete exploits, all with tainted data in the context signal:\n- `\u003ca bq-bind:href=\"link\"\u003e` with `link = \"javascript:alert(document.cookie)\"` → clickable script execution.\n- `\u003cimg bq-bind:src=\"u\"\u003e` / `\u003ciframe bq-bind:src=\"u\"\u003e` with a `javascript:`/`data:` URL.\n- `\u003cdiv bq-bind:onclick=\"h\"\u003e` with `h = \"alert(1)\"` → `setAttribute('onclick', …)` registers an inline handler.\n\n**SSR variant (`srcdoc`):** the SSR `bq-bind` implementation *does* block `on*` and validates a fixed URL-attribute list, but `srcdoc` on `\u003ciframe\u003e` is neither, and `\u003ciframe\u003e` is not stripped by the serializers. Attribute-encoding is insufficient because the browser decodes entities and parses `srcdoc` as a full HTML document:\n```\nInput:  \u003ciframe bq-bind:srcdoc=\"msg\"\u003e\u003c/iframe\u003e   msg = '\u003cscript\u003ealert(1)\u003c/script\u003e'\nOutput: \u003ciframe ... srcdoc=\"\u0026lt;script\u0026gt;alert(1)\u0026lt;/script\u0026gt;\"\u003e\u003c/iframe\u003e   → executes\n```\n\n## Suggested fix\nIn `handleBind` (and the SSR equivalents), for URL-bearing attributes (`href`, `src`, `action`, `formaction`, `xlink:href`, `poster`, `background`, `srcset`) run the value through the security module's `isSafeUrl`/`isSafeSrcset` and drop it on failure; refuse (or warn on) `on*` attribute names; treat `srcdoc` as an HTML sink (drop, sanitize, or require explicit opt-in). Prefer an **allowlist** of bind-target attributes over a denylist, and reuse `src/security` rather than re-implementing.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:02:46.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/164/bQuery/issues/164"}