Listen to this Post
djust built-in component template tags render developer/user-supplied URLs into href and action attributes.
They HTML-escape those URL values with conditional_escape.
HTML escaping prevents attribute breakout by escaping quotes and angle brackets.
HTML escaping does not neutralize a javascript: URI.
javascript: URIs need no escapable characters to execute.
A value such as javascript:alert(document.cookie) remains intact.
It lands verbatim in .
When the victim clicks the link, the JavaScript executes.
Execution happens in the victim’s authenticated session.
Affected sinks include breadcrumb at djust_components.py:1535.
Affected sinks include _advanced.py:1999 and _advanced.py:2022.
Affected sinks include dj_nav link at djust_components.py:5632.
Affected sinks include dj_nav dropdown at djust_components.py:5779.
Affected sinks include dj_nav brand at djust_components.py:5807 and :5830.
Affected sinks include citation URL at djust_components.py:6936.
Affected sinks include cookie-consent privacy link at djust_components.py:8240.
Affected sinks include error-page action at _advanced.py:1728.
Affected sinks include form action at _forms.py:1239.
sinks are lower risk because javascript: does not execute via img src.
No scheme validation exists anywhere in the component tags.
A docstring at djust_components.py:781 acknowledges the javascript: risk.
The docstring does not mitigate the javascript: risk.
Severity is Medium because exploitation depends on developer usage.
It is XSS in the victim’s authenticated session when user-controllable data is rendered.
For href sinks, exploitation requires a click.
Worst case is stored XSS when a URL persists from one user to another.
Reproduction with breadcrumb(items=[{“label”:”Home”,”url”:”javascript:alert(document.cookie)”}]) emits Home.
The JaVaScRiPt: case variant also passes.
https:// URLs are preserved.
Patches should add a safe_url() helper.
safe_url() should neutralize non-allowlisted schemes to .
Non-allowlisted schemes include javascript:, vbscript:, and data:.
safe_url() should preserve http/https/mailto/tel/relative/anchor URLs.
Every href/action/formaction/xlink:href sink should route through safe_url then HTML-escape.
A regression test and audit_ast/system-check rule should flag un-routed URL-attribute interpolation.
Workaround: do not pass user-controllable URLs to affected built-in component tags.
Workaround: pre-validate URL schemes in application code before binding component arguments.
DailyCVE Form:
Platform: djust
Version: Unspecified
Vulnerability: javascript URI XSS
Severity: Medium
date: Unspecified
Prediction: Expected patch unspecified
What Undercode Say:
Analytics:
grep -R "conditional_escape" djust/components/templatetags/ grep -R "href=|action=|formaction=" djust/components/templatetags/.py grep -R "javascript:" djust/components/templatetags/.py
from djust.components.templatetags.djust_components import breadcrumb
payload = "javascript:alert(document.cookie)"
print(breadcrumb(items=[{"label": "Home", "url": payload}]))
payload = "JaVaScRiPt:alert(document.cookie)"
print(breadcrumb(items=[{"label": "Home", "url": payload}]))
Exploit: (Educational Purposes!)
breadcrumb(items=[{"label": "Home", "url": "javascript:alert(document.cookie)"}])
<a ... href="javascript:alert(document.cookie)">Home</a>
Protection: from this CVE
def safe_url(url):
allowed = ("http://", "https://", "mailto:", "tel:", "/", "")
if url.lower().startswith(("javascript:", "vbscript:", "data:")):
return ""
if url.startswith(allowed):
return url
return ""
from django.utils.html import conditional_escape def render_href(url): return conditional_escape(safe_url(url))
Audit un-routed URL-attribute interpolation
grep -R "href=\"{{" djust/components/templatetags/
grep -R "action=\"{{" djust/components/templatetags/
grep -R "formaction=\"{{" djust/components/templatetags/
Impact:
XSS in the victim’s authenticated session when user-controllable URLs reach affected component tags. For href sinks, exploitation requires a click. Worst case is stored XSS when a URL persists from one user and is rendered to another. Severity is Medium because exploitation is conditional on developer usage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
