From 42dc36cc10088c2d34359a353fd6d1ac5b11b4b7 Mon Sep 17 00:00:00 2001
From: jvoisin <julien.voisin@dustri.org>
Date: Wed, 15 Apr 2026 23:03:30 +0200
Subject: [PATCH] Escape comment columns names

Custom columns of type comments are rendered with `|safe` (disabling Jinja2
auto-escaping) and no `clean_string` sanitization. Compare with regular book
comments which correctly use `{{ entry.comments[0].text|clean_string|safe }}`.

Any user with edit permissions can set a custom comment column to
`<script>alert(document.cookie)</script>` and it will execute for every user who
views the book detail page or the OPDS feed. This is stored XSS with no
authentication barrier beyond edit permission.
---
 cps/templates/detail.html    | 2 +-
 cps/templates/feed.xml       | 2 +-
 cps/templates/listenmp3.html | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/cps/templates/detail.html b/cps/templates/detail.html
index 164ac424d..638b28bf7 100644
--- a/cps/templates/detail.html
+++ b/cps/templates/detail.html
@@ -232,7 +232,7 @@
                                         {% elif c.datatype == 'datetime' %}
                                             {{ column.value|formatdate }}
                                         {% elif c.datatype == 'comments' %}
-                                            {{ column.value|safe }}
+                                            {{ column.value|clean_string|safe }}
                                         {% elif c.datatype == 'series' %}
                                             {{ '%s [%s]' % (column.value, column.extra|formatfloat(2)) }}
                                         {% elif c.datatype == 'text' %}
diff --git a/cps/templates/feed.xml b/cps/templates/feed.xml
index 6627daac4..70ebc14b7 100644
--- a/cps/templates/feed.xml
+++ b/cps/templates/feed.xml
@@ -94,7 +94,7 @@
                             {% elif c.datatype == 'datetime' %}
                                 {{ column.value|formatdate }}
                             {% elif c.datatype == 'comments' %}
-                                {{ column.value|safe }}
+                                {{ column.value|clean_string|safe }}
                             {% elif c.datatype == 'series' %}
                                 {{ '%s [%s]' % (column.value, column.extra|formatfloat(2)) }}
                             {% elif c.datatype == 'text' %}
diff --git a/cps/templates/listenmp3.html b/cps/templates/listenmp3.html
index 375a871b4..836c80928 100644
--- a/cps/templates/listenmp3.html
+++ b/cps/templates/listenmp3.html
@@ -134,7 +134,7 @@
                 {% elif c.datatype == 'datetime' %}
                   {{ column.value|formatdate }}
                 {% elif c.datatype == 'comments' %}
-                  {{column.value|safe}}
+                  {{column.value|clean_string|safe}}
                 {% elif c.datatype == 'series' %}
                   {{ '%s [%s]' % (column.value, column.extra|formatfloat(2)) }}
                 {% elif c.datatype == 'text' %}