[DupFileManager] Report and advance options load third-party script into a page holding the Stash API key

[johnkattenhorn]

Summary

DupFileManager's generated report and its advanced options page both load JavaScript from https://www.axter.com/js/, and both pages hold the user's Stash API key. Third-party script therefore executes in a page that has full API access to the user's Stash instance.

This is a design/supply-chain issue rather than an active exploit — nothing is known to be wrong with the domain today. The point is that the security of every DupFileManager user's Stash instance currently depends on a single third-party domain staying under its owner's control indefinitely.

The two facts that combine

1. The pages load remote script with no integrity pinning

DupFileManager_report_config.py:187-189 (the generated duplicate report):

<script src="https://www.axter.com/js/jquery-3.7.1.min.js"></script>
<script src="https://www.axter.com/js/jquery.prompt.js"></script>
<link rel="stylesheet" href="https://www.axter.com/js/jquery.prompt.css"/>

advance_options.html:93-95 loads the same three.

No integrity / SRI attribute, so a changed file at that URL is executed without complaint.

2. Those same pages hold the API key

DupFileManager_report_config.py:191 declares var apiKey = "", and line 225 attaches it to every request to Stash:

$.ajaxSetup({beforeSend: function(xhr) {xhr.setRequestHeader('apiKey', apiKey);}});

Line 349 then passes it to the options page in the URL query string:

newUrl = newUrl.replace(/report\/DuplicateTagScenes[_0-9]*.html/g,
    "advance_options.html?GQL=" + GraphQl_URL + "&apiKey=" + apiKey);

and advance_options.html:100-101 reads it back out of location.search.

Impact

Any party able to serve content at www.axter.com/js/ — through domain expiry and re-registration, DNS or hosting compromise, or an MITM on a user who reaches the page over plain HTTP — gets arbitrary JavaScript execution in a page holding a valid Stash API key. From there: read the entire library, and drive any mutation the API allows, including scene and file deletion.

For users who expose Stash beyond their LAN, that is reachable remotely.

Two smaller issues in the same area:

• API key in a query string leaks into browser history, and into Referer headers on any outbound request from that page — including the requests to axter.com. Worth moving out of the URL regardless of the rest.
• advance_options.html:126 does console.log("Using apiKey = " + apiKey), writing the key to the browser console.

Suggested fixes

In rough order of value:

1. Vendor the three files into the plugin directory and reference them relatively. The plugin already ships its own JS and CSS, so this removes the external dependency entirely and costs about 90 KB. This alone closes the main issue.
2. Stop passing the key in the URL. sessionStorage, or a postMessage from the opener, keeps it out of history and Referer.
3. Drop the console.log of the key.
4. If vendoring is genuinely unwanted, a well-known CDN with SRI hashes and crossorigin is a meaningful improvement on an unpinned personal domain — though vendoring is still better for a self-hosted, often-offline application.

Notes

• This affects DupFileManager only. The axter.com references in FileMonitor and RenameFile are author-attribution comments in headers, not resource loads.
• Found while testing an unrelated fix (DupFileManager: merge play and O history instead of discarding it #759) by driving the plugin's report through a browser against a throwaway Stash v0.31.1 instance.
• Raised publicly because the repository has no SECURITY.md and private vulnerability reporting is not enabled. Happy to move this somewhere private if maintainers would prefer.
• Not intended as criticism of the plugin or its author — DupFileManager is doing useful work, and this is a pattern that was entirely normal web practice for years. It just sits badly with an API key in the same page.