From b858e8d1085ef01faaf77162a6a2973e17a47aaa Mon Sep 17 00:00:00 2001
From: Leo <leo@yacy-contrib>
Date: Mon, 20 Apr 2026 22:51:47 +0800
Subject: fix: HTML-escape crawled document metadata in ViewFile parsed view to
 prevent XSS (#630)

dc_title, dc_creator, dc_subject, dc_description, dc_publisher, dc_format, and
dc_identifier were all written with prop.put() and rendered unescaped in HTML
<dd> elements. A malicious page title like <script>... would execute in the
viewer's browser. Switch to prop.putHTML() for all dc_* metadata fields.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 source/net/yacy/htroot/ViewFile.java | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/source/net/yacy/htroot/ViewFile.java b/source/net/yacy/htroot/ViewFile.java
index 25d9d0072..0ec25cf4d 100644
--- a/source/net/yacy/htroot/ViewFile.java
+++ b/source/net/yacy/htroot/ViewFile.java
@@ -279,13 +279,14 @@ public class ViewFile {
                 final String content = document.getTextString();
                 // content = wikiCode.replaceHTML(content); // added by Marc Nause
                 prop.put("viewMode", VIEW_MODE_AS_PARSED_TEXT);
-                prop.put("viewMode_title", document.dc_title());
-                prop.put("viewMode_creator", document.dc_creator());
-                prop.put("viewMode_subject", document.dc_subject(','));
-                prop.put("viewMode_description", document.dc_description().length == 0 ? new String[]{""} : document.dc_description());
-                prop.put("viewMode_publisher", document.dc_publisher());
-                prop.put("viewMode_format", document.dc_format());
-                prop.put("viewMode_identifier", document.dc_identifier());
+                prop.putHTML("viewMode_title", document.dc_title());
+                prop.putHTML("viewMode_creator", document.dc_creator());
+                prop.putHTML("viewMode_subject", document.dc_subject(','));
+                final String[] descs = document.dc_description();
+                prop.putHTML("viewMode_description", descs.length == 0 ? "" : String.join("; ", descs));
+                prop.putHTML("viewMode_publisher", document.dc_publisher());
+                prop.putHTML("viewMode_format", document.dc_format());
+                prop.putHTML("viewMode_identifier", document.dc_identifier());
                 prop.put("viewMode_source", url.toNormalform(false));
                 prop.put("viewMode_lat", document.lat());
                 prop.put("viewMode_lon", document.lon());
-- 
cgit v1.2.3