· ai-devtools
XSS in yarr RSS reader
yarr is an open source RSS reader written in Go.
I use it myself in my homelab and I was interested one day how yarr loads and renders this content. Taking a look at their source we can see how. When you add an RSS feed, each post within the feed is treated as an "item" within yarr's object model.
When this loads the post from a remote url it first passes the content through the Sanitize function. This one is rather self explanatory. // Sanitize returns safe HTML. func Sanitize(baseURL, input string) string { tokenizer := html.NewTokenizer(bytes.NewBufferString(input)) ... attrNames, htmlAttributes := sanitizeAttributes(baseURL, tagName, token.Attr) The sanitised content is returned in the "content" value of the response after it is serialised to JSON. And from here dynamically rendered into the DOM.
With this model in mind, it was clear that if there was a gap in the sanitisation logic it would lead to XSS. So I took a closer look at how the function was implemented.
