[SECURITY]: XSS Vulnerability in TurtleBlocksJS Text Block Label Input

[karthik-dev56]

Summary

A Cross-Site Scripting (XSS) vulnerability exists in the TurtleBlocksJS activity where user input from text block labels is directly inserted into HTML without proper sanitization.

Location

• File: activities/TurtleBlocksJS.activity/js/block.js
• Line: 1501
• Function: showLabel()

Vulnerable Code

// A place in the DOM to put modifiable labels (textareas).
var labelValue = (this.label)?this.label.value:this.value;
var labelElem = docById('labelDiv');

if (this.name === 'text') {
    var type = 'text';
    labelElem.innerHTML = '<input id="textLabel" style="position: absolute; -webkit-user-select: text;-moz-user-select: text;-ms-user-select: text;" class="text" type="text" value="' + labelValue + '" />';
    labelElem.classList.add('hasKeyboard');
    this.label = docById('textLabel');
}

Steps to Reproduce

1. Open TurtleBlocksJS activity
2. Create a new "text" block from the palette
3. Double-click to edit the text block
4. Enter malicious payload: "><script>alert('XSS')</script><"
5. Save the block and edit it again
6. XSS payload executes

Impact

• Severity: High
• Attack Vector: User can inject arbitrary JavaScript code
• Scope: Affects anyone using TurtleBlocksJS activity
• Risk: Code execution in user's browser context

Root Cause

User input from this.label.value flows directly into innerHTML without HTML escaping, allowing HTML/JavaScript injection.

[walterbender]

Can you check this in the musicblocks repo to see if it has been fixed there?

[karthik-dev56]

Hey @walterbender I have gone through the PR'S the issue is not fixed.. The existing XSS fix #5446 is specific to the Reflection widget and not related to block label rendering... SO fixx is needed

[bharti78]

This is a very interesting fix.
I’m going through the changes to understand how the sanitization for block labels is handled.
Is there any other similar area in TurtleBlocksJS where input sanitization is still pending?
I would love to help with that.

[walterbender]

I need to rebase Turtle Blocks JS from the Music Blocks code. We don't do patches directly in Turtle Blocks anymore.