Repository navigation
Verify HTML page reflects receipt fields unescaped (stored XSS) #11
Description
Activity
Implemented in PR #13.
The verifier HTML page now escapes receipt metadata, query, answer, signer, Merkle root, and verification details before rendering. Added an API regression test with a valid signed receipt containing script and event-handler markup; the response contains escaped entities and no raw tags.
Validation: Python 3.11 and 3.12 each pass all 86 tests, ruff passes, the demo verifies a genuine receipt and rejects a tampered one, and the package build succeeds. GitHub Actions CI passed for both Python versions in run 34025580828.
Receipt signing, canonical serialization, verification results, and the JSON
/verifyendpoint are unchanged.- added a commit that references this issue
on Sep 6, 2026
Problem
The verify HTML page interpolates receipt fields raw (
{p.query},{p.answer}) with nohtml.escapeanywhere in the file: a stored query like<script>alert(1)</script>renders as live script.Where
src/answerproof/api.py(_render_page).Acceptance
Add a failing test first rendering a page with HTML metachars in query/answer, expecting escaped entities and no raw
<script>. Then fix.