This repository has been archived by the owner on Feb 15, 2023. It is now read-only.
Fix tag name filtering that could result in XSS #375
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
gumbo_tag_from_original_text
currently usesisspace
to detect illegal whitespaces in tag names.isspace
will match on\v
and\r
, which are not illegal according to the spec (https://html.spec.whatwg.org/multipage/syntax.html#tag-name-state).This can result in an XSS that will not be possible in a standard-compliant parser: In the current implementation,
gumbo_tag_from_original_text
will return<script>
on the unknown element<script\v>
(or<script\rnotreallyscript>
).Serializers relaying on
gumbo_tag_from_original_text
(such asprettyprint
) will transform non-executable<script\v>
tags to executable<script>
tags.This diff applies the whitelist in the spec to
gumbo_tag_from_original_text
and adds unit-tests for this scenario.