From 4794db76b0f7536ce409734fe7818a8ac0ce558e Mon Sep 17 00:00:00 2001
From: Ole-Morten Duesund <olemd@glemt.net>
Date: Wed, 26 Aug 2026 12:18:47 +0200
Subject: [PATCH] Fjern inline onsubmit med innholdstekst (XSS i JS-attributt)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Jinja escaper for HTML, men nettleseren dekoder attributtverdien før
JS-parseren ser den, så en tittel med ' kunne bryte ut av strengen.
Bekreftelser går nå via data-confirm og én delt handler i base.html.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JcEy43fNYpwg6K6oTKakWR
---
 soapbox/templates/admin/base.html  |  8 ++++++++
 soapbox/templates/admin/edit.html  |  6 ++----
 soapbox/templates/admin/users.html |  2 +-
 tests/test_app.py                  | 11 +++++++++++
 4 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/soapbox/templates/admin/base.html b/soapbox/templates/admin/base.html
index 7dd3d33..cba78ab 100644
--- a/soapbox/templates/admin/base.html
+++ b/soapbox/templates/admin/base.html
@@ -32,5 +32,13 @@
 {% endwith %}
 {% block content %}{% endblock %}
 </main>
+<script>
+// Bekreftelsesdialoger via data-attributt i stedet for inline onsubmit, slik at
+// tekst fra innhold (titler, brukernavn) aldri havner i en JS-kontekst.
+document.addEventListener("submit", function (ev) {
+  var msg = ev.target.dataset && ev.target.dataset.confirm;
+  if (msg && !confirm(msg)) ev.preventDefault();
+});
+</script>
 </body>
 </html>
diff --git a/soapbox/templates/admin/edit.html b/soapbox/templates/admin/edit.html
index 4e6223e..3944193 100644
--- a/soapbox/templates/admin/edit.html
+++ b/soapbox/templates/admin/edit.html
@@ -56,8 +56,7 @@
     <li>
       <img src="{{ url_for('admin.media', post_id=post.id, filename=name) }}" alt="" loading="lazy">
       <code>![]({{ name }})</code>
-      <form method="post" action="{{ url_for('admin.delete_image', post_id=post.id) }}" class="inline"
-            onsubmit="return confirm('Slette {{ name }}?')">
+      <form method="post" action="{{ url_for('admin.delete_image', post_id=post.id) }}" class="inline" data-confirm="Slette {{ name }}?">
         <input type="hidden" name="csrf" value="{{ csrf }}">
         <input type="hidden" name="filename" value="{{ name }}">
         <button type="submit" class="link danger">Slett</button>
@@ -68,8 +67,7 @@
 </details>
 {% endif %}
 
-<form method="post" action="{{ url_for('admin.delete', post_id=post.id) }}" class="danger-zone"
-      onsubmit="return confirm('Slette hele innlegget «{{ post.title }}»?')">
+<form method="post" action="{{ url_for('admin.delete', post_id=post.id) }}" class="danger-zone" data-confirm="Slette hele innlegget «{{ post.title }}»?">
   <input type="hidden" name="csrf" value="{{ csrf }}">
   <button type="submit" class="link danger">Slett innlegget</button>
 </form>
diff --git a/soapbox/templates/admin/users.html b/soapbox/templates/admin/users.html
index e1c3c18..ad07771 100644
--- a/soapbox/templates/admin/users.html
+++ b/soapbox/templates/admin/users.html
@@ -17,7 +17,7 @@
         <label>Nytt passord <input type="password" name="password" minlength="8" required autocomplete="new-password"></label>
         <button type="submit">Sett passord</button>
       </form>
-      <form method="post" class="inline" onsubmit="return confirm('Slette brukeren {{ u.username }}? Innleggene beholdes i git.')">
+      <form method="post" class="inline" data-confirm="Slette brukeren {{ u.username }}? Innleggene beholdes i git.">
         <input type="hidden" name="csrf" value="{{ csrf }}">
         <input type="hidden" name="action" value="delete">
         <input type="hidden" name="user_id" value="{{ u.id }}">
diff --git a/tests/test_app.py b/tests/test_app.py
index 03f399f..0cf9bfb 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -146,3 +146,14 @@ def test_subpath_mount(tmp_path):
     assert 'href="theme/style.css"' in html
     assert re.search(r'href="admin/"', html)
     assert client.get("/blog/theme/style.css").status_code == 200
+
+
+def test_no_inline_js_with_content(client, cfg):
+    """Titler med anførselstegn skal ikke havne i en JS-kontekst (XSS)."""
+    post_id = _create_post(client)
+    token = csrf(client)
+    title = "Ola's \"test\" <b>"
+    r = client.post(f"/admin/edit/{post_id}", data={"csrf": token, "title": title, "body": "x", "action": "save"})
+    html = client.get(r.headers["Location"]).text
+    assert "onsubmit" not in html and "onclick" not in html
+    assert "Ola&#39;s" in html