Space bug in `clean_text`
Date: 2022-06
Affected: rust/ammonia
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-79

An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug: let html = format!("<div title={}>", clean_text(user_supplied_string)); Applications are not affected if they quote their attributes, or if they don't use `clean_text` at all.


Mitigations:

Architectural layers (MAESTRO):