Incomplete HTML escaping by Xapian::MSet::snippet()

Olly Betts via Xapian-discuss <[email protected]> Fri, 14 Aug 2026 14:00:57 +1200

Newsgroups	gmane.comp.search.xapian.general
Message-ID	<[email protected]>

Hello folks,

Back in 2018 I spotted that the HTML escaping done by
Xapian::MSet::snippet() was incomplete.  We fixed this at the time, but
this week Arpit Jain spotted that we'd missed fixing a corner case.

This affects 2.0.0 and 1.4.x for x <= 22.  Hopefully nobody is still
using 1.2.x, but that is unaffected as it didn't have MSet::snippet().

I released 1.4.23 and 2.0.1 today which both include a fix.  If you want
to cherry-pick the fix and apply it to an older release, you can find
patches at:

https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update

The bug is that no escaping happens if empty strings are passed for both
hi_start and hi_end, and text.size() <= length.

If those conditions can be triggered, there's potential for an attacker
who can feed documents into a system to inject HTML markup into results
pages for some searches.

We suspect empty highlighting strings are an unusual way to use this
method and haven't managed to find any real world example of such use,
but the fix is small and unlikely to cause problems so we recommend
applying it, or auditing your code to check it doesn't call
MSet::snippet() in this way.

If you maintain packages of xapian-core, I'd strongly encourage you to
upgrade to a fixed version or apply the patch (I'm working through the
process of doing so for Debian, where I also maintain packages of
xapian-core).

Cheers,
    Olly

signature.asc (application/pgp-signature, 833 B)