diff --git a/CHANGES.md b/CHANGES.md --- a/CHANGES.md +++ b/CHANGES.md @@ -23,6 +23,29 @@ See also the hledger changelog. +# 1.52.2 2026-08-24 + +Fixes + +- An XSS (cross-site scripting) vulnerability has been fixed in the add + transaction form's autocomplete. Journal data from an untrusted source + could execute javascript when shown as a completion suggestion. All + hledger-web users are encouraged to upgrade. Full technical details: + GHSA-538p-cvc4-4qjm. + (Arthur Cinader, Simon Michael, #2698) + + Note: this bug was detected, and the original patch was generated, by + Arthur Cinader with AI assistance, for hledger 2.x. Because the + vulnerability is in theory quite severe, and the fix is small and + obvious, and I don't want to add risk by redoing it from memory, and + no-one else volunteered promptly to do that work - and after + discussion in the chat and mail list (see today's thread), and careful + human review and testing - I manually backported the same fix to + hledger 1. And, updated the project's https://hledger.org/AI.html + policy to allow this for needed security-related fixes like this one + (which I expect to be very rare). + + # 1.52.1 2026-04-28 Improvements diff --git a/hledger-web.1 b/hledger-web.1 --- a/hledger-web.1 +++ b/hledger-web.1 @@ -1,5 +1,5 @@ -.TH "HLEDGER\-WEB" "1" "March 2026" "hledger-web-1.52 " "hledger User Manuals" +.TH "HLEDGER\-WEB" "1" "March 2026" "hledger-web-1.52.1 " "hledger User Manuals" @@ -17,7 +17,7 @@ .PD \f[CR]hledger web [OPTS] [QUERY]\f[R] .SH DESCRIPTION -This manual is for hledger\(aqs web interface, version 1.52. +This manual is for hledger\(aqs web interface, version 1.52.1. See also the hledger manual for common concepts and file formats. .PP hledger is a robust, user\-friendly, cross\-platform set of programs for diff --git a/hledger-web.cabal b/hledger-web.cabal --- a/hledger-web.cabal +++ b/hledger-web.cabal @@ -1,11 +1,11 @@ cabal-version: 2.2 --- This file has been generated from package.yaml by hpack version 0.39.1. +-- This file has been generated from package.yaml by hpack version 0.39.6. -- -- see: https://github.com/sol/hpack name: hledger-web -version: 1.52.1 +version: 1.52.2 synopsis: Web user interface for the hledger accounting system description: A simple web user interface for the hledger accounting system, providing a more modern UI than the command-line or terminal interfaces. @@ -154,7 +154,7 @@ hs-source-dirs: ./ ghc-options: -Wall -Wno-incomplete-uni-patterns -Wno-missing-signatures -Wno-orphans -Wno-type-defaults -Wno-unused-do-bind -threaded - cpp-options: -DVERSION="1.52.1" + cpp-options: -DVERSION="1.52.2" build-depends: Decimal >=0.5.1 , aeson >=1 && <2.3 @@ -176,8 +176,8 @@ , filepath , githash >=0.1.6.2 , hjsmin - , hledger >=1.52.1 && <1.53 - , hledger-lib >=1.52.1 && <1.53 + , hledger >=1.52.2 && <1.53 + , hledger-lib >=1.52.2 && <1.53 , hspec , http-client , http-conduit @@ -222,7 +222,7 @@ hs-source-dirs: app ghc-options: -Wall -Wno-incomplete-uni-patterns -Wno-missing-signatures -Wno-orphans -Wno-type-defaults -Wno-unused-do-bind -threaded - cpp-options: -DVERSION="1.52.1" + cpp-options: -DVERSION="1.52.2" build-depends: base >=4.18 && <4.23 , hledger-web @@ -242,7 +242,7 @@ hs-source-dirs: test ghc-options: -Wall -Wno-incomplete-uni-patterns -Wno-missing-signatures -Wno-orphans -Wno-type-defaults -Wno-unused-do-bind -threaded - cpp-options: -DVERSION="1.52.1" + cpp-options: -DVERSION="1.52.2" build-depends: base >=4.18 && <4.23 , hledger-web diff --git a/hledger-web.info b/hledger-web.info --- a/hledger-web.info +++ b/hledger-web.info @@ -18,7 +18,7 @@ or 'hledger web [OPTS] [QUERY]' - This manual is for hledger's web interface, version 1.52. See also + This manual is for hledger's web interface, version 1.52.1. See also the hledger manual for common concepts and file formats. hledger is a robust, user-friendly, cross-platform set of programs @@ -528,15 +528,15 @@  Tag Table: Node: Top223 -Node: OPTIONS2575 -Node: PERMISSIONS11473 -Node: EDITING UPLOADING DOWNLOADING12623 -Node: RELOADING13638 -Node: JSON API14205 -Node: DEBUG OUTPUT19854 -Node: Debug output20006 -Node: ENVIRONMENT20524 -Node: BUGS20760 +Node: OPTIONS2577 +Node: PERMISSIONS11475 +Node: EDITING UPLOADING DOWNLOADING12625 +Node: RELOADING13640 +Node: JSON API14207 +Node: DEBUG OUTPUT19856 +Node: Debug output20008 +Node: ENVIRONMENT20526 +Node: BUGS20762  End Tag Table diff --git a/hledger-web.txt b/hledger-web.txt --- a/hledger-web.txt +++ b/hledger-web.txt @@ -11,7 +11,7 @@ hledger web [OPTS] [QUERY] DESCRIPTION - This manual is for hledger's web interface, version 1.52. See also the + This manual is for hledger's web interface, version 1.52.1. See also the hledger manual for common concepts and file formats. hledger is a robust, user-friendly, cross-platform set of programs for @@ -470,4 +470,4 @@ SEE ALSO hledger(1), hledger-ui(1), hledger-web(1), ledger(1) -hledger-web-1.52 March 2026 HLEDGER-WEB(1) +hledger-web-1.52.1 March 2026 HLEDGER-WEB(1) diff --git a/static/hledger.js b/static/hledger.js --- a/static/hledger.js +++ b/static/hledger.js @@ -123,7 +123,7 @@ // or it will recursively add helper elements for those, causing confusion (#2215). newrow.find('.tt-hint').remove(); newrow.find('.tt-input').removeClass('tt-input'); - accountfield.typeahead({ highlight: true }, { source: globalThis.accountsCompleter.ttAdapter() }); + accountfield.typeahead({ highlight: true }, { source: globalThis.accountsCompleter.ttAdapter(), templates: { suggestion: globalThis.suggestionTemplate } }); // Add the new row to the page. $('#addform .account-postings').append(newrow); diff --git a/templates/add-form.hamlet b/templates/add-form.hamlet --- a/templates/add-form.hamlet +++ b/templates/add-form.hamlet @@ -20,9 +20,16 @@ }); globalThis.accountsCompleter.initialize(); + // use template to ensure proper escaping + globalThis.suggestionTemplate = function(d) { + var p = document.createElement('p'); + p.textContent = d.value; + return p; + }; + // Attach the completers to the initial form inputs. - jQuery('input[name=description]').typeahead({ highlight: true }, { source: globalThis.descriptionsCompleter.ttAdapter() }); - jQuery('input[name=account]' ).typeahead({ highlight: true }, { source: globalThis.accountsCompleter.ttAdapter() }); + jQuery('input[name=description]').typeahead({ highlight: true }, { source: globalThis.descriptionsCompleter.ttAdapter(), templates: { suggestion: globalThis.suggestionTemplate } }); + jQuery('input[name=account]' ).typeahead({ highlight: true }, { source: globalThis.accountsCompleter.ttAdapter(), templates: { suggestion: globalThis.suggestionTemplate } }); }); const utf8textdecoder = new TextDecoder();