Summary

Two security fixes for fire.fundersclub.com, both surfaced by a recent pentest:

1. Stored XSS via unescaped JSON in a <script> block (the high-severity one)

app_html injects MeView.get_me_data() into a <script> block using json.dumps(), which does not escape <, >, or &. A repository's emailmap_set contains attacker-influenceable sender email addresses (from_email), so a crafted address could break out of the script element and execute in a repo admin's browser when they load /repos.

Fix: escape <, >, & to their \uXXXX forms before injection (U+2028/U+2029 are already escaped by json.dumps' ensure_ascii default), matching Django's json_script scheme. This neutralizes the payload regardless of who plants it.

2. Missing HSTS in production

firebot/settings/prod.py set SECURE_SSL_REDIRECT and secure cookies but never set HSTS headers. Added SECURE_HSTS_SECONDS (1 year), includeSubDomains, and preload.

Notes

• The pentest also flagged the associate-email POST authorization. After investigation we deliberately left it as is_authenticated-only: that endpoint is designed for external (non-admin) senders to self-link their email, so requiring repo-admin would break the feature. The XSS escaping above is the actual remediation; the residual identity-binding weakness is low severity and accepted.
• No existing test covers app_html; a regression test asserting a </script> payload in ME_DATA is escaped would be a good follow-up.

🤖 Generated with Claude Code