sanitize-html 2.17.2 → 2.17.4

package/README.md

@@ -695,13 +695,13 @@ Normally, with a few exceptions, if a tag is not allowed, all of the text within
 
 The exceptions are:
 
-`style`, `script`, `textarea`, `option`
+`style`, `script`, `textarea`, `option`, `xmp`
 
 If you wish to replace this list, for instance to discard whatever is found
 inside a `noscript` tag, use the `nonTextTags` option:
 
 ```js
-nonTextTags: [ 'style', 'script', 'textarea', 'option', 'noscript' ]
+nonTextTags: [ 'style', 'script', 'textarea', 'option', 'xmp', 'noscript' ]
 ```
 
 Note that if you use this option you are responsible for stating the entire list. This gives you the power to retain the content of `textarea`, if you want to.

package/index.js

@@ -4,6 +4,7 @@ const { isPlainObject } = require('is-plain-object');
 const deepmerge = require('deepmerge');
 const parseSrcset = require('parse-srcset');
 const { parse: postcssParse } = require('postcss');
+const { naughtyHref: launderNaughtyHref } = require('launder');
 // Tags that can conceivably represent stand-alone media.
 const mediaTags = [
   'img', 'audio', 'video', 'picture', 'svg',
@@ -135,11 +136,16 @@ function sanitizeHtml(html, options, _recursing) {
   // the text when the tag is disallowed makes sense for other reasons.
   // If we are not allowing these tags, we should drop their content too.
   // For other tags you would drop the tag but keep its content.
+  // `xmp` is included because htmlparser2 treats it as a raw-text element,
+  // so markup inside is parsed as text on input but would otherwise be
+  // re-emitted unescaped via the `ontext` branch below, allowing XSS bypass
+  // when `xmp` is disallowed (which is the default).
   const nonTextTagsArray = options.nonTextTags || [
     'script',
     'style',
     'textarea',
-    'option'
+    'option',
+    'xmp'
   ];
   let allowedAttributesMap;
   let allowedAttributesGlobMap;
@@ -566,10 +572,14 @@ function sanitizeHtml(html, options, _recursing) {
         // your concern, don't allow them. The same is essentially true for style tags
         // which have their own collection of XSS vectors.
         result += text;
-      } else if ((options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') && (nonTextTagsArray.indexOf(tag) !== -1)) {
-        // htmlparser2 does not decode entities inside raw text elements like
-        // textarea and option. The text is already properly encoded, so pass
-        // it through without additional escaping to avoid double-encoding.
+      } else if ((options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') && (tag === 'textarea' || tag === 'xmp')) {
+        // htmlparser2 treats <textarea> and <xmp> as raw text elements and
+        // does NOT decode entities inside them. The text is already properly
+        // encoded, so pass it through without additional escaping to avoid
+        // double-encoding. Other "nonTextTags" like <option> are not raw text
+        // elements in htmlparser2, so their contents are decoded and must be
+        // escaped below like any other text (important to prevent XSS via
+        // entity-encoded payloads such as <option>&lt;script&gt;...&lt;/script&gt;</option>).
         result += text;
       } else if (!addedText) {
         const escaped = escapeHtml(text, false);
@@ -722,45 +732,15 @@ function sanitizeHtml(html, options, _recursing) {
   }
 
   function naughtyHref(name, href) {
-    // Browsers ignore character codes of 32 (space) and below in a surprising
-    // number of situations. Start reading here:
-    // https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_tab
-    // eslint-disable-next-line no-control-regex
-    href = href.replace(/[\x00-\x20]+/g, '');
-    // Clobber any comments in URLs, which the browser might
-    // interpret inside an XML data island, allowing
-    // a javascript: URL to be snuck through
-    while (true) {
-      const firstIndex = href.indexOf('<!--');
-      if (firstIndex === -1) {
-        break;
-      }
-      const lastIndex = href.indexOf('-->', firstIndex + 4);
-      if (lastIndex === -1) {
-        break;
-      }
-      href = href.substring(0, firstIndex) + href.substring(lastIndex + 3);
-    }
-    // Case insensitive so we don't get faked out by JAVASCRIPT #1
-    // Allow more characters after the first so we don't get faked
-    // out by certain schemes browsers accept
-    const matches = href.match(/^([a-zA-Z][a-zA-Z0-9.\-+]*):/);
-    if (!matches) {
-      // Protocol-relative URL starting with any combination of '/' and '\'
-      if (href.match(/^[/\\]{2}/)) {
-        return !options.allowProtocolRelative;
-      }
-
-      // No scheme
-      return false;
-    }
-    const scheme = matches[1].toLowerCase();
-
-    if (has(options.allowedSchemesByTag, name)) {
-      return options.allowedSchemesByTag[name].indexOf(scheme) === -1;
-    }
-
-    return !options.allowedSchemes || options.allowedSchemes.indexOf(scheme) === -1;
+    // Resolve the per-tag scheme allowlist if one is configured for
+    // this tag, otherwise fall back to the global allowedSchemes.
+    const allowedSchemes = has(options.allowedSchemesByTag, name)
+      ? options.allowedSchemesByTag[name]
+      : (options.allowedSchemes || []);
+    return launderNaughtyHref(href, {
+      allowedSchemes,
+      allowProtocolRelative: options.allowProtocolRelative
+    });
   }
 
   function parseUrl(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanitize-html",
-  "version": "2.17.2",
+  "version": "2.17.4",
   "description": "Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis",
   "sideEffects": false,
   "main": "index.js",
@@ -27,11 +27,12 @@
     "htmlparser2": "^10.1.0",
     "is-plain-object": "^5.0.0",
     "parse-srcset": "^1.0.2",
-    "postcss": "^8.3.11"
+    "postcss": "^8.3.11",
+    "launder": "^1.7.1"
   },
   "devDependencies": {
     "eslint": "^9.39.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.7.5",
     "sinon": "^9.0.2",
     "eslint-config-apostrophe": "^6.0.2"
   },