One skipped escape call left Telegram Desktop's HTML export open to stored XSS for 28 months

According to the dev.to write-up of the findings, Telegram Desktop draws messages with its own UI framework, not a browser engine, so a literal `<script>` tag in a bot's button text appeared as plain characters ^[9]. The researchers padded the payload with invisible Unicode, and in the client they tested the button looked empty ^[10]. The HTML export does interpret that string as markup. It writes the string into a file, a browser opens the file, and the characters run as code ^[11].

One string had two consumers with different rules. The client was safe because of how it draws text, and nothing had cleaned the data itself ^[9][6]. The write-up says this split also removed the usual precondition for stored XSS: write access to the place the payload lands ^[13]. In its example, a bot message carrying the payload sits in a chat for months until someone exports it ^[17].

The escaping function itself was sound. SerializeString() in export_output_html.cpp escapes the five HTML-significant characters, converts newlines to `<br>` and hex-encodes ASCII control characters ^[4]. The failure was one call site. The vulnerable line was `block.append(button.text.toUtf8())` ^[6]. Commit 8457d13a, by Telegram Desktop developer John Preston, changed it to `block.append(SerializeString(button.text.toUtf8()))` ^[7]. Bug and fix differ by one function name and a pair of parentheses ^[6][7].

We would study the second injection hardest. Its context was a JavaScript string inside an HTML attribute ^[8]. Backslash is not among the characters SerializeString() handles ^[4], so that context needed escaping of its own.

The write-up describes the general failure this way: a template has eleven fields, ten get escaped, and the eleventh is a string treated as just a label ^[14]. For the Telegram lesson to apply to another app, three things have to hold. User-controlled strings reach an HTML writer. The primary display renders those strings safely by some other route. Someone opens the output in a browser. The Telegram export met all three ^[9][11].

In our view the fix that lasts is structural. An HTML writer should escape on every append by default and allow raw output only through a separately named call. Then an unescaped field has to be written on purpose, and a reviewer can see it.