Overview - Ghost

Ghost

7 days30 days

Latest CI Pipeline Executions

Fuzzy

Succeeded
29013
c1d2b62e 🐛 Fixed stored XSS and mangled structured data in JSON-LD output ref https://github.com/TryGhost/Ghost/pull/28957 - tag names, post keywords, and the site title were serialized raw into the inline <script type="application/ld+json"> block, letting an Editor-controlled value like `foo</script><script>...` break out of the script element and run arbitrary JS for anonymous visitors on tag and post pages - escapes the breakout-relevant characters (< > U+2028 U+2029) as JSON \u escapes at the single serialization boundary in ghost_head, so every field is covered at once instead of relying on per-field escaping that is easy to forget - removed the per-field escapeExpression calls from schema.js: HTML-entity escaping is the wrong layer here — JSON-LD consumers (Google et al.) parse the block as JSON and never HTML-decode, so it silently corrupted structured data (e.g. `Tom & Jerry` was indexed as `Tom & Jerry`). JSON \u escapes are both safe and lossless, so legitimate `& ' "` now round-trip correctly - added a regression test proving breakout is neutralised while data round-trips, and updated the snapshot/assertions that were capturing the old corruption
by Steve Larson
Succeeded
29013
de1fcb7e 🐛 Fixed stored XSS and mangled structured data in JSON-LD output ref https://github.com/TryGhost/Ghost/pull/28957 - tag names, keywords, titles and author fields were written into the inline <script type="application/ld+json"> block, but escaping was applied per-field with escapeExpression (HTML-entity encoding) - that approach both missed fields (tag name, keywords, site title — an Editor-controlled `</script>` broke out and executed for anon visitors, see #28957) and corrupted the data that JSON-LD consumers read, e.g. `Tom & Jerry` was indexed by search engines as `Tom & Jerry` - fixed both at the correct layer: escape once on the serialised JSON at the render sink in ghost_head (mirroring the existing `json` helper's </>/& approach), which neutralises the script breakout for every field, current and future, while preserving the original values for parsers - removed the now-redundant per-field escapeExpression calls from schema.js so URLs, names and keywords are no longer double/entity-encoded
by Steve Larson