CVE-2023-44390 (C#, published 2023-10-05T14:15Z)
Description: value: HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. The vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version).
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mganss/HtmlSanitizer
Files changed:
test/HtmlSanitizer.Tests/Tests.cs
Commit message: Merge branch 'advisory-fix-1'


Vulnerable code:

Fixed code:
+
     [Fact]
     public void BypassTest()
     {
         var sanitizer = new HtmlSanitizer();
         sanitizer.AllowedTags.Add("svg");
         sanitizer.AllowedTags.Add("title");
         sanitizer.AllowedTags.Add("xmp");
         var bypass = @"<svg></p><title><xmp></title><img src=x onerror=alert(1)></xmp></title>";
         var sanitized = sanitizer.Sanitize(bypass, "https://www.example.com");
         var expected = @"<svg><p></p><title><xmp>&lt;/title&gt;&lt;img src=x onerror=alert(1)&gt;</xmp></title></svg>";
         Assert.Equal(expected, sanitized);
     }
 
     [Fact]
     public void Bypass2Test()
     {
         var sanitizer = new HtmlSanitizer();
         sanitizer.AllowedTags.Add("form");
         sanitizer.AllowedTags.Add("math");
         sanitizer.AllowedTags.Add("mtext");
         sanitizer.AllowedTags.Add("mglyph");
         sanitizer.AllowedTags.Add("xmp");
         var bypass = @"<form><math><mtext></form><form><mglyph><xmp></math><img src onerror=alert(1)>";
         var sanitized = sanitizer.Sanitize(bypass, "https://www.example.com");
         var expected = @"<form><math><mtext><form><mglyph><xmp>&lt;/math&gt;&lt;img src onerror=alert(1)&gt;</xmp></mglyph></form></mtext></math></form>";
         Assert.Equal(expected, sanitized);
     }
 
     [Fact]
     public void Bypass3Test()
     {
         var sanitizer = new HtmlSanitizer();
         sanitizer.AllowedTags.Add("svg");
         sanitizer.AllowedTags.Add("title");
         sanitizer.AllowedTags.Add("noscript");
         var bypass = @"<svg></p><title><noscript></title><img src=x onerror=alert(1)></noscript></title>";
         var sanitized = sanitizer.Sanitize(bypass, "https://www.example.com");
         var expected = "<svg><p></p><title><noscript>&lt;/title&gt;&lt;img src=x onerror=alert(1)&gt;</noscript></title></svg>";
         Assert.Equal(expected, sanitized);
     }
 
     [Fact]
     public void Bypass4Test()
     {
         var sanitizer = new HtmlSanitizer();
         sanitizer.AllowedTags.Add("svg");
         sanitizer.AllowedTags.Add("p");
         sanitizer.AllowedTags.Add("style");
         sanitizer.RemovingComment += (s, e) => e.Cancel = true;
         var bypass = @"<svg></p><style><!--</style><img src=x onerror=alert(1)>-->";
         var sanitized = sanitizer.Sanitize(bypass, "https://www.example.com");
         var expected = "<svg><p></p><style><!--&lt;/style&gt;&lt;img src=x onerror=alert(1)&gt;--></style></svg>";
         Assert.Equal(expected, sanitized);
     }