XSS on login form

[cgod]

• code-server version: code-server2.1698-vsc1.41.1-darwin-x86_64
• OS Version: MacOS 10.14.6

Description

Login form echoes bad password back to page without any sanitization.

Steps to Reproduce

Attempt to log in with password:

"><script>alert('hi')</script>

Browser alert with message "hi" is displayed, and form shows

" required autofocus onfocus="const value=this.value;this.value='';this.value=value;">

This text could easily be hidden by starting a new tag at the end of the password, but I've left it to help illustrate the issue.

There is generally no good reason for inserting a bad password back into the input, so simply not doing that should mitigate this particular instance.

In its current state, it seems likely that a malicious site could post to this form (since there's also no CSRF protection) with a password that would inject code that could steal the site cookies, replace the login form and steal entered password, etc.