From 62a327e3bc82ae90170ace48d6a3c2b99aa6f563 Mon Sep 17 00:00:00 2001 From: Zhang Peng Date: Thu, 9 Apr 2026 14:16:28 +0800 Subject: [PATCH] gi-docgen: fix CVE-2025-11687 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2025-11687: A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS). Reference: [https://nvd.nist.gov/vuln/detail/CVE-2025-11687] Upstream patch: [https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/c53d2640bfa5823bbdf33683d95c160267c0ec68] (From OE-Core rev: 76c1f08fadad94098bd265d662eb5a0408c95efc) Signed-off-by: Zhang Peng Signed-off-by: Jinfeng Wang Signed-off-by: Yoann Congal Signed-off-by: Paul Barker --- .../gi-docgen/files/CVE-2025-11687.patch | 90 +++++++++++++++++++ .../gi-docgen/gi-docgen_2023.3.bb | 5 +- 2 files changed, 94 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-gnome/gi-docgen/files/CVE-2025-11687.patch diff --git a/meta/recipes-gnome/gi-docgen/files/CVE-2025-11687.patch b/meta/recipes-gnome/gi-docgen/files/CVE-2025-11687.patch new file mode 100644 index 0000000000..8a0c15e4a8 --- /dev/null +++ b/meta/recipes-gnome/gi-docgen/files/CVE-2025-11687.patch @@ -0,0 +1,90 @@ +From 0e97b155ff1b15bc3173118561316d8ea28ec9b7 Mon Sep 17 00:00:00 2001 +From: Emmanuele Bassi +Date: Fri, 10 Oct 2025 17:06:22 +0100 +Subject: [PATCH] Make sure to escape query strings + +Unescaped query strings should not be passed to the HTML parser, to +avoid unwanted execution of JavaScript. + +The query is shown in the header of the search results, so we can easily +split the header from the results; then we use a plain text node to +represent the query, and let the browser escape it. + +See: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html + +Fixes: #228 + +CVE: CVE-2025-11687 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/c53d2640bfa5823bbdf33683d95c160267c0ec68] + +Signed-off-by: Zhang Peng +--- + gidocgen/templates/basic/search.js | 30 +++++++++++++++++++----------- + 1 file changed, 19 insertions(+), 11 deletions(-) + +diff --git a/gidocgen/templates/basic/search.js b/gidocgen/templates/basic/search.js +index 29c204f..628f0a6 100644 +--- a/gidocgen/templates/basic/search.js ++++ b/gidocgen/templates/basic/search.js +@@ -182,17 +182,24 @@ function hideSearchResults() { + } + } + +-function renderResults(query, results) { +- let html = ""; ++function createResultsTitle(query, n_results) { ++ // Ensure we're returning an escaped query string, to ensure we ++ // prevent XSS vulnerabilities ++ let h1 = document.createElement("h1"); ++ let text = document.createTextNode("Results for “" + query + "” (" + n_results + ")"); ++ h1.appendChild(text) ++ return h1; ++} + +- html += "

Results for "" + query + "" (" + results.length + ")

" + +- "
" ++function createResultsContent(results) { ++ let search_results = document.createElement("div"); ++ search_results.setAttribute("id", "search-results"); + + if (results.length === 0) { +- html += "No results found."; ++ search_results.textContent = "No results found."; + } + else { +- html += "
"; ++ let html = "
"; + results.forEach(function(item) { + html += "
" + + "" + item.text + "" + +@@ -204,11 +211,11 @@ function renderResults(query, results) { + "
" + item.summary + "
"; + }); + html += "
"; +- } + +- html += "
"; ++ search_results.innerHTML = html; ++ } + +- return html; ++ return search_results; + } + + function showResults(query, results) { +@@ -218,9 +225,10 @@ function showResults(query, results) { + window.history.replaceState(refs.input.value, "", baseUrl + extra + window.location.hash); + } + +- window.title = "Results for: " + query; ++ window.title = "Results for “" + query + "” (" + results.length + ")"; + window.scroll({ top: 0 }) +- refs.search.innerHTML = renderResults(query, results); ++ refs.search.appendChild(createResultsTitle(query, results.length)); ++ refs.search.appendChild(createResultsContent(results)); + showSearchResults(search); + } + +-- +2.50.0 + diff --git a/meta/recipes-gnome/gi-docgen/gi-docgen_2023.3.bb b/meta/recipes-gnome/gi-docgen/gi-docgen_2023.3.bb index 54d7ef7513..53641bcbe3 100644 --- a/meta/recipes-gnome/gi-docgen/gi-docgen_2023.3.bb +++ b/meta/recipes-gnome/gi-docgen/gi-docgen_2023.3.bb @@ -8,7 +8,10 @@ HOMEPAGE = "https://gnome.pages.gitlab.gnome.org/gi-docgen/" LICENSE = "GPL-3.0-or-later & Apache-2.0" LIC_FILES_CHKSUM = "file://gi-docgen.py;beginline=1;endline=5;md5=2dc0f1f01202478cfe813c0e7f80b326" -SRC_URI = "git://gitlab.gnome.org/GNOME/gi-docgen.git;protocol=https;branch=main" +SRC_URI = "\ + git://gitlab.gnome.org/GNOME/gi-docgen.git;protocol=https;branch=main \ + file://CVE-2025-11687.patch \ + " SRCREV = "96f2e9b93e1d8a5338eb05b87fd879856ab7b3cc"