MSet::snippet() returns unescaped text when hi_start and hi_end are both empty

[Olly Betts]

On Tue, Aug 11, 2026 at 07:47:04PM +0900, Arpit Jain wrote:
> Since Xapian publishes no private security contact, I am writing to the
> list rather than putting this anywhere more public; my name is Arpit Jain
> and I work on open-source supply-chain security.

FWIW, this list has multiple external public archives.  Probably our bug
tracker is actually less public than this list.

> I think Xapian::MSet::snippet() in xapian-core breaks its documented
> HTML-escaping guarantee on one fast path: when hi_start and hi_end are both
> empty and the text already fits inside length, it returns the caller's text
> byte for byte with no escaping.

Indeed - thanks for reporting.  As you identified, it's effectively a
missed case from CVE-2018-0499.

I've pushed fixes to main and RELEASE/1.4.  I'm already working on new
releases so this should hopefully be in releases soon.

> Severity and classification (my read, your call)
> ------------------------------------------------
> Medium. CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N. CWE-116, with CWE-79
> as the downstream effect. AC is High because the impact depends on a caller
> configuration the attacker does not control, and scope is Changed because
> the consequence lands in the embedding application's browser context rather
> than in Xapian.

Sorry, I don't know what any of that means!

I'd expect that it's uncommon to pass empty hi_start and hi_end,
especially when used in a web context (since end users will expect
search terms to be highlighted in snippets because that's (a) helpful
and (b) what pretty much every search system does).

I used Debian codesearch to find code in software packaged by Debian
which uses MSet::snippet() (unfortunately there are a lot of unrelated
matches as well):

https://codesearch.debian.net/search?q=(%5C.%7C-%3E)%5Cb*snippet%5Cb*%5C(%5B%5E')0-9%5D&literal=0

All the calls I found use non-empty hi_start and hi_end.  That's likely
a subset of users of this API but at least indicative.

Cheers,
    Olly