CVE-2022-36020: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-09-13T17:15Z
Repository: https://github.com/TYPO3/html-sanitizer
Language: PHP
Files changed: composer.json, tests/ScenarioTest.php
Commit date: 2022-09-13 09:29:06 +0200
Commit message: [SECURITY] Correctly handle comment end bang state (#86)

Upgrade to https://github.com/Masterminds/html5-php/releases/tag/2.7.6

Security-References: CVE-2022-36020
Diff: diff --git a/composer.json b/composer.json
index cae52a5..a682cf1 100644
--- a/composer.json
+++ b/composer.json
@@ -14,11 +14,11 @@
 			"dev-main": "2.x-dev"
 		}
 	},
 	"require": {
 		"ext-dom": "*",
-		"masterminds/html5": "^2.7",
+		"masterminds/html5": "^2.7.6",
 		"php": "^7.2 || ^8.0",
 		"psr/log": "^1.0 || ^2.0 || ^3.0"
 	},
 	"require-dev": {
 		"phpunit/phpunit": "^8.5"
diff --git a/tests/ScenarioTest.php b/tests/ScenarioTest.php
index 4ab7084..4df460f 100644
--- a/tests/ScenarioTest.php
+++ b/tests/ScenarioTest.php
@@ -19,10 +19,32 @@ use TYPO3\HtmlSanitizer\Behavior;
 use TYPO3\HtmlSanitizer\Sanitizer;
 use TYPO3\HtmlSanitizer\Visitor\CommonVisitor;
 
 class ScenarioTest extends TestCase
 {
+    public static function allTagsAreRemovedOnMissingDeclarationDataProvider(): array
+    {
+        return [
+            ['<div class="content">value</div><span class="content">value</span>', ''],
+            ['<!--any--><div class="content">value</div>', '<!--any-->'],
+            ['<!--any--!><div class="content">value</div>', '<!--any-->'],
+        ];
+    }
+
+    /**
+     * @test
+     * @dataProvider allTagsAreRemovedOnMissingDeclarationDataProvider
+     */
+    public function allTagsAreRemovedOnMissingDeclaration(string $payload, string $expectation): void
+    {
+        $behavior = new Behavior();
+        $sanitizer = new Sanitizer(
+            new CommonVisitor($behavior)
+        );
+        self::assertSame($expectation, $sanitizer->sanitize($payload));
+    }
+
     public static function tagFlagsAreProcessedDataProvider(): array
     {
         return [
             [
                 Behavior\Tag::ALLOW_CHILDREN + Behavior\Tag::PURGE_WITHOUT_CHILDREN,

Vulnerable code: 		"masterminds/html5": "^2.7",
Fixed code: 		"masterminds/html5": "^2.7.6",
    public static function allTagsAreRemovedOnMissingDeclarationDataProvider(): array
    {
        return [
            ['<div class="content">value</div><span class="content">value</span>', ''],
            ['<!--any--><div class="content">value</div>', '<!--any-->'],
            ['<!--any--!><div class="content">value</div>', '<!--any-->'],
        ];
    }

    /**
     * @test
     * @dataProvider allTagsAreRemovedOnMissingDeclarationDataProvider
     */
    public function allTagsAreRemovedOnMissingDeclaration(string $payload, string $expectation): void
    {
        $behavior = new Behavior();
        $sanitizer = new Sanitizer(
            new CommonVisitor($behavior)
        );
        self::assertSame($expectation, $sanitizer->sanitize($payload));
    }