Gửi #1041301: sunkaifei FlyCms master Improper Neutralization of Alternate XSS Syntax

Stored XSS: Lack of input sanitization during content submission and failure to escape output on the detail page.

In short: Any registered user can inject a `<script>` tag into the body of a post. Once the post is published, the script executes in the browser of any visitor who views the detail page.

The vulnerability stems from two combined oversights:

| Stage | Code Location | Issue |
| :--- | :--- | :--- |
| Data Ingestion | `ModelDataService#insertData:474` | Only external images are downloaded locally; no HTML sanitization (e.g., via Jsoup) is performed. |
| Data Output | `articles/detail.html:28` (and 19 other locations) `${(info.content)!''}` | The `?html` escape directive is missing, and the template engine does not escape content by default. |

Key prerequisites:

• Registration is open, and the submission endpoint only verifies the user's login status.
• The `content` field is included in the allowed-field whitelist.
• The `fly_model` table lacks an `enable_submit` column, meaning this validation check always passes.
• The configuration `fly_article_audit = '0'` results in `status = "1"`, allowing posts to be published immediately without undergoing moderation.

Verification: Testing with the actual FreeMarker 2.3.32 engine and the production template files confirms that the payload is rendered exactly as provided. In contrast, using `.ftlh` files or explicitly adding `?html` correctly escapes the content. The root cause of this discrepancy is that the `outputFormat` is set to `undefined`; the `<#ftl output_format="HTML">` directive defined in `spring.ftl` is not being propagated to the page templates.

Impact: Attackers can hijack visitor sessions, perform administrative actions, or conduct phishing attacks. There is no `script-src` policy defined in the Content Security Policy (CSP), leaving no fallback protection.

• Nguồn: ⚠️ https://github.com/sunkaifei/FlyCms/issues/18
• Người dùng: s1mple_xy (UID 82894)
• Đệ trình: 18/10/2026 17:32 (cách đây 22 ngày)
• Kiểm duyệt: 09/11/2026 18:11 (22 days later)
• Trạng thái: được chấp nhận
• Mục VulDB: 433192 [sunkaifei FlyCMS đến e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a Content Rendering articles/detail.html ModelDataService.insertData content Tập lệnh chéo trang]
• điểm: 20