MSet::snippet() returns unescaped text when hi_start and hi_end are both empty

[Arpit Jain]

Thanks for the quick fix, and for the correction about the list. I had that
backwards: I treated it as the private option because there was no security
contact, when it has public archives and the bug tracker would have been
the less exposed route. I will use the tracker for Xapian in future.

On the severity block, I will drop it. Plain version: this only bites a
caller who passes empty hi_start and hi_end and then renders the snippet as
HTML, and your codesearch is good evidence that essentially nobody does the
first part. So the real-world exposure is low and I would not argue for
treating it as more than a correctness fix.

Thanks again,
Arpit

On Wed, Aug 12, 2026 at 8:51 AM Olly Betts <olly at survex.com> wrote:

> On Tue, Aug 11, 2026 at 07:47:04PM +0900, Arpit Jain wrote:
> > Since Xapian publishes no private security contact, I am writing to the
> > list rather than putting this anywhere more public; my name is Arpit Jain
> > and I work on open-source supply-chain security.
>
> FWIW, this list has multiple external public archives.  Probably our bug
> tracker is actually less public than this list.
>
> > I think Xapian::MSet::snippet() in xapian-core breaks its documented
> > HTML-escaping guarantee on one fast path: when hi_start and hi_end are
> both
> > empty and the text already fits inside length, it returns the caller's
> text
> > byte for byte with no escaping.
>
> Indeed - thanks for reporting.  As you identified, it's effectively a
> missed case from CVE-2018-0499.
>
> I've pushed fixes to main and RELEASE/1.4.  I'm already working on new
> releases so this should hopefully be in releases soon.
>
> > Severity and classification (my read, your call)
> > ------------------------------------------------
> > Medium. CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N. CWE-116, with
> CWE-79
> > as the downstream effect. AC is High because the impact depends on a
> caller
> > configuration the attacker does not control, and scope is Changed because
> > the consequence lands in the embedding application's browser context
> rather
> > than in Xapian.
>
> Sorry, I don't know what any of that means!
>
> I'd expect that it's uncommon to pass empty hi_start and hi_end,
> especially when used in a web context (since end users will expect
> search terms to be highlighted in snippets because that's (a) helpful
> and (b) what pretty much every search system does).
>
> I used Debian codesearch to find code in software packaged by Debian
> which uses MSet::snippet() (unfortunately there are a lot of unrelated
> matches as well):
>
>
> https://codesearch.debian.net/search?q=(%5C.%7C-%3E)%5Cb*snippet%5Cb*%5C(%5B%5E')0-9%5D&literal=0
>
> All the calls I found use non-empty hi_start and hi_end.  That's likely
> a subset of users of this API but at least indicative.
>
> Cheers,
>     Olly
>


-- 
Thanks,
Arpit
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xapian.org/pipermail/xapian-devel/attachments/20260812/7fd16687/attachment.htm>