Script tags not stripped from feed titles on /feeds endpoint

[rwhogg]

I believe I have discovered an XSS issue in Stringer (the most recent version pushed to Docker Hub).

Here's a POC for it:

1. Run Stringer using the instructions in https://github.com/swanson/stringer/blob/master/docs/docker.md (The SQLite and Docker Compose instructions instructions both work.)
2. Serve an RSS feed that has an entity-encoded script tag in its title. (i.e. <script>alert('xss')</script> )
3. Add your webserver for that feed to Stringer
4. Go to the /feeds endpoint in your browser. You should see the alert.

I have created an example RSS feed that demonstrates this at https://gist.github.com/rwhogg/1a7b9e9f82db6fdfb266af2cd09cfb9a

[swanson]

Thanks for the report. Here is the relevant section of the code: https://github.com/swanson/stringer/blob/master/app/repositories/story_repository.rb#L106-L117

We are using the loofah gem for sanitization: https://github.com/flavorjones/loofah but it sounds like this case is not being caught. Not sure if there is a problem with the library or our usage of it.

We should be able to add a failing test for this scenario as well: https://github.com/swanson/stringer/blob/master/spec/repositories/story_repository_spec.rb

[rwhogg]

Thanks Victor!