GHSA-9q4r-x2hj-jmvr: copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

The vulnerability is a DOM-based Cross-Site Scripting (XSS) issue in copyparty caused by rendering unsanitized multimedia metadata. The analysis of the provided patch commit 895880aeb0be0813ddf732487596633f8f9fc3a6 was the key to identifying the vulnerable functions.

The commit modified a single file, copyparty/web/browser.js, in two distinct locations. Both changes involved adding an escaping function, esc(), to variables that held metadata tag values before they were added to arrays used for HTML generation.

By inspecting the source code of copyparty/web/browser.js around the patched lines, I identified the enclosing functions. The changes were located within two different functions, both named render, but residing in different JavaScript modules (search_ui and treectl) created using the IIFE pattern.

1. The first vulnerable function, which I've identified as search_ui.render, is responsible for rendering search results. The unescaped metadata was being added to the nodes array.
2. The second vulnerable function, treectl.render, is responsible for rendering the file browser tree. Here, the unescaped metadata was being added to the ln array.

These functions are the direct points of vulnerability because they process and prepare the malicious data for display without proper sanitization. An attacker can exploit this by crafting a malicious multimedia file (or an .m3u playlist) with specially crafted metadata tags containing JavaScript payloads. When a user views the directory containing this file or loads the malicious playlist, the vulnerable render functions execute, injecting the payload into the DOM and triggering the XSS. The provided function names include the module they belong to for clarity, as a runtime profiler would likely provide this contextual information.