From 425038b2af6e35efef3625176d5f2f849b6dccc9 Mon Sep 17 00:00:00 2001
From: Devon Kirk <hyder365@users.noreply.github.com>
Date: Mon, 29 Jun 2026 21:54:43 -0400
Subject: [PATCH] fix: escape special_anchor in HtmlOutput JS string literal

HtmlOutput() interpolates settings.special_anchor into a JavaScript
string literal via g_strdup_printf("%s") inside a <script> tag.
The value originates from the '#' or '!' fragment of sword:// URLs,
which are constructed from untrusted BibleSync navigation packets
(biblesync_glue.cc:179) and module content hyperlinks
(wk-html.c:96).  A crafted ref containing #";alert(1);}// breaks
out of the JS string and executes arbitrary script in the
JS-enabled WebKit2 view with file:// origin.

Escape the anchor with g_strescape() before interpolation to
neutralize backslash, double-quote, and other JS string literal
metacharacters.
---
 src/gtk/utilities.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/gtk/utilities.c b/src/gtk/utilities.c
index 2f786af72..6b833f021 100644
--- a/src/gtk/utilities.c
+++ b/src/gtk/utilities.c
@@ -1299,11 +1299,21 @@ HtmlOutput(char *text, GtkWidget *gtkText, MOD_FONT *mf, char *anchor)
 		len -= offset;
 
 		// now write the javascript snippet.
+		// escape the anchor for safe interpolation into a JS
+		// string literal.  special_anchor can originate from
+		// untrusted BibleSync navigation packets whose ref
+		// field carries the '#' fragment; without escaping a
+		// crafted value can break out of the string and inject
+		// script into the WebKit view.
+		const gchar *raw_anchor =
+		    (settings.special_anchor ? settings.special_anchor : anchor);
+		gchar *esc_anchor = g_strescape(raw_anchor, NULL);
 		buf =
 		    g_strdup_printf("<script type=\"text/javascript\" language=\"javascript\">"
 				    " window.onload = function () { window.location.hash = \"%s\"; }"
 				    " </script>",
-				    (settings.special_anchor ? settings.special_anchor : anchor));
+				    esc_anchor);
+		g_free(esc_anchor);
 		XIPHOS_HTML_WRITE(html, buf, strlen(buf));
 		g_free(buf);
 	}