MSet::snippet() returns unescaped text when hi_start and hi_end are both empty

[Olly Betts]

On Wed, Aug 12, 2026 at 02:02:20PM +0900, Arpit Jain wrote:
> Thanks for the quick fix, and for the correction about the list. I had that
> backwards: I treated it as the private option because there was no security
> contact, when it has public archives and the bug tracker would have been
> the less exposed route. I will use the tracker for Xapian in future.

I think it was a reasonable assumption.

Perhaps we should create a security contact email address, but we're
averaging a security fix every 8-9 years so an open address will
inevitably get far more spam, non-security-related messages, etc than
actual reports.  Even ignoring the developer time that wastes, it means
there's a significant risk of reports being missed amongst the noise.

Is there a good approach to this that other projects with very
infrequent security reports use?

> On the severity block, I will drop it. Plain version: this only bites a
> caller who passes empty hi_start and hi_end and then renders the snippet as
> HTML,

The text supplied to snippet() would also need to be under an attacker's
control (or they'd need to find existing content in the system which
happened to be short enough but contain something suitable).  Sometimes
it is (e.g. in a webmail frontend) but often it isn't so that further
reduces where this could be exploited.

> and your codesearch is good evidence that essentially nobody does the
> first part. So the real-world exposure is low and I would not argue for
> treating it as more than a correctness fix.

I agree real-world exposure is low, but it's hard to know how the API
gets used (and codesearch only shows us a subset), so for people
maintaining packages of xapian-core my recommendation would be to apply
the patch (or package a version with the fix) since it's a simple patch
with very low risk of unwanted side effects.

At least for the Debian package (which I happen to also maintain) I'm
intending to submit the patch for the stable release via the security
queue, which gets to more users sooner than a stable update would.

Cheers,
    Olly