Description

@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin

Summary

Anonymous GitHub fetches repository content (e.g., markdown files) from GitHub's API and renders it without sanitization. On the client side, markdown is parsed with marked (with sanitize: false) and injected into the DOM via $sce.trustAsHtml() + ng-bind-html, bypassing AngularJS's built-in XSS protection. An attacker can craft a malicious GitHub repository whose README executes arbitrary JavaScript in the Anonymous GitHub origin.

Details

README fetched from GitHub API

The server fetches the README via GitHub's REST API and stores the raw markdown in MongoDB:

// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/src/core/source/GitHubRepository.ts#L162-L174
const ghRes = await oct.repos.getReadme({
  owner: this.owner,
  repo: this.repo,
  ref: selected?.commit,
});
const readme = Buffer.from(
  ghRes.data.content,...
Show more

It is then served to the client with no sanitization:

// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/src/server/routes/repository-private.ts#L254-L260
return res.send(
  await repo.readme({
    accessToken: token,
    force: req.query.force == "1",
    branch: req.query.branch as string,
  })
);...
Show more

Client-side rendering via $sce.trustAsHtml() + ng-bind-html

The client fetches the raw README, parses it with renderMD() (which uses marked with sanitize: false), then bypasses AngularJS sanitization:

// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/public/script/app.js#L1219-L1226
const res = await $http.get(`/api/repo/${o.owner}/${o.repo}/readme`, {
  params: { force: force === true ? "1" : "0", branch: $scope.source.branch },
});
$scope.readme = res.data;

// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/public/script/app.js#L1339-L1343
const html = renderMD(
  $scope.anonymize_readme,
  `https://github.com/${o.owner}/${o.repo}/raw/${$scope.source.branch}/`
);
$scope.html_readme = $sce.trustAsHtml(html);  // sink: bypasses Angular XSS protection

The renderMD() function explicitly disables sanitization:

// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/public/script/utils.js#L165-L176
marked.setOptions({
  sanitize: false,  // HTML in markdown is preserved as-is
  // ...
});
return marked.parse(md, { renderer });

The resulting HTML is bound to the DOM via ng-bind-html, which trusts the string marked by $sce.trustAsHtml() and inserts it as innerHTML.

Impact

Stored XSS: Any malicious GitHub repository can execute JavaScript in the Anonymous GitHub origin when a user anonymizes it or views its content

Account Takeover: Steal authentication tokens and session cookies

Data Exfiltration: Access other users' anonymization configurations and private repository data via /api/user and /api/repo/list

Proof of Concept

Create a GitHub repository with a malicious README.md:

# Innocent README
<img src=x onerror="alert(document.domain)">

On Anonymous GitHub, enter the malicious repository URL to anonymize it

The XSS executes immediately when the README preview is rendered on the anonymize page

Remediation

Sanitize markdown output with DOMPurify before rendering (the dependency already exists but is unused)

Serve HTML files with Content-Disposition: attachment or in a sandboxed iframe on a separate origin

Replace $sce.trustAsHtml() with proper ngSanitize usage

HTML-escape filenames and paths in directory listing templates

Add Content Security Policy headers

Credits

Zhengyu Liu, Jingcheng Yang

Mitigation

Aliases

References