CVE-2011-2931: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2011-08-29T18:55Z
Repository: https://github.com/rails/rails
Language: Ruby
Files changed: actionpack/lib/action_controller/vendor/html-scanner/html/node.rb, actionpack/test/template/html-scanner/sanitizer_test.rb
Commit date: 2011-08-16 15:24:48 -0700
Commit message: Tags with invalid names should also be stripped in order to prevent
XSS attacks.  Thanks Sascha Depold for the report.

Diff: diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
index 22b324310..4e1f01643 100644
--- a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
+++ b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
@@ -154,11 +154,11 @@ def parse(parent, line, pos, content, strict=true)
 
             return CDATA.new(parent, line, pos, scanner.pre_match.gsub(/<!\[CDATA\[/, ''))
           end
 
           closing = ( scanner.scan(/\//) ? :close : nil )
-          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/)
+          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[^\s!>\/]+/)
           name.downcase!
 
           unless closing
             scanner.skip(/\s*/)
             attributes = {}
diff --git a/actionpack/test/template/html-scanner/sanitizer_test.rb b/actionpack/test/template/html-scanner/sanitizer_test.rb
index 678cb9eee..62ad6be68 100644
--- a/actionpack/test/template/html-scanner/sanitizer_test.rb
+++ b/actionpack/test/template/html-scanner/sanitizer_test.rb
@@ -3,10 +3,17 @@
 class SanitizerTest < ActionController::TestCase
   def setup
     @sanitizer = nil # used by assert_sanitizer
   end
 
+  def test_strip_tags_with_quote
+    sanitizer = HTML::FullSanitizer.new
+    string    = '<" <img src="trollface.gif" onload="alert(1)"> hi'
+
+    assert_equal ' hi', sanitizer.sanitize(string)
+  end
+
   def test_strip_tags
     sanitizer = HTML::FullSanitizer.new
     assert_equal("<<<bad html", sanitizer.sanitize("<<<bad html"))
     assert_equal("<<", sanitizer.sanitize("<<<bad html>"))
     assert_equal("Dont touch me", sanitizer.sanitize("Dont touch me"))

Vulnerable code:           return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/)
Fixed code:           return Text.new(parent, line, pos, content) unless name = scanner.scan(/[^\s!>\/]+/)
  def test_strip_tags_with_quote
    sanitizer = HTML::FullSanitizer.new
    string    = '<" <img src="trollface.gif" onload="alert(1)"> hi'

    assert_equal ' hi', sanitizer.sanitize(string)
  end