From 6e384c96516a5f77d4a513d46a00e447c6ac3652 Mon Sep 17 00:00:00 2001
From: Closure Team <closure-library-bot@google.com>
Date: Thu, 2 Mar 2023 07:34:18 -0800
Subject: [PATCH] Stops sanitizing the #src attribute for `<img>`, `<video>`,
 `<audio>` and `<source>`. These sinks don't execute javascript: URLs in
 modern browsers anymore.

RELNOTES: Stops sanitizing the #src attribute for `<img>`, `<video>`, `<audio>` and <source>.
PiperOrigin-RevId: 513533137
Change-Id: I038549c81200fafb0b6db6f1856b9744a51773c1
---
 .../goog/html/sanitizer/html_test_vectors.js  | 144 +++++-------------
 1 file changed, 39 insertions(+), 105 deletions(-)
diff --git a/closure/goog/html/sanitizer/html_test_vectors.js b/closure/goog/html/sanitizer/html_test_vectors.js
index 7ea6b77919..5f160fe070 100644
--- a/closure/goog/html/sanitizer/html_test_vectors.js
+++ b/closure/goog/html/sanitizer/html_test_vectors.js
@@ -11,6 +11,38 @@ goog.provide('goog.html.htmlTestVectors');
 goog.setTestOnly();
 
 goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
+    {input: "<a href=\"javascript:alert('xss');\">foo</a>",
+     acceptable: [
+         "<a href=\"javascript:void(0);\">foo</a>",
+         "<a href=\"about:invalid#zGoSafez\">foo</a>",
+         "<a href=\"about:invalid#zCSafez\">foo</a>",
+         "<a>foo</a>",
+         "<a href=\"unsafe:javascript:alert('xss');\">foo</a>",
+         "<a href=\"about:invalid#zClosurez\">foo</a>",
+         "<a href=\"javascript:alert('xss');\" >foo</a>",
+     ],
+     name: "a"},
+    {input: "<a href=javascript:alert(&quot;XSS&quot;)>foo</a>",
+     acceptable: [
+         "<a href=\"javascript:void(0);\">foo</a>",
+         "<a href=\"about:invalid#zGoSafez\">foo</a>",
+         "<a>foo</a>",
+         "<a href=\"about:invalid#zCSafez\">foo</a>",
+         "<a href=\"unsafe:javascript:alert(&#34;XSS&#34;)\">foo</a>",
+         "<a href=\"about:invalid#zClosurez\">foo</a>",
+     ],
+     name: "a_quot"},
+    {input: "<a href=\"jav&#x09;ascript:alert('xss');\">foo</a>",
+     acceptable: [
+         "<a href=\"javascript:void(0);\">foo</a>",
+         "<a href=\"about:invalid#zGoSafez\">foo</a>",
+         "<a href=\"about:invalid#zCSafez\">foo</a>",
+         "<a>foo</a>",
+         "<a href=\"unsafe:jav&#9;ascript:alert('xss');\">foo</a>",
+         "<a href=\"about:invalid#zClosurez\">foo</a>",
+         "<a href=\"jav&#9;ascript:alert('xss');\">foo</a>",
+     ],
+     name: "a_tab"},
     {input: "<body onload=alert('xss')>",
      acceptable: [
          "",
@@ -67,19 +99,6 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
          "<iframe />",
      ],
      name: "iframe_srcdoc"},
-    {input: "<img src=\"javascript:alert('xss');\">",
-     acceptable: [
-         "<img src=\"javascript:void(0);\">",
-         "<img src=\"about:invalid#zGoSafez\"/>",
-         "<img src=\"about:invalid#zCSafez\" />",
-         "<img src=\"about:invalid#zCSafez\">",
-         "<img>",
-         "<img />",
-         "<img src=\"unsafe:javascript:alert('xss');\">",
-         "<img src=\"about:invalid#zTSz\" />",
-         "<img src=\"about:invalid#zClosurez\" />",
-     ],
-     name: "img"},
     {input: "<!--<img src=\"--><img src=x onerror=alert('xss')//\">",
      acceptable: [
          "<img />",
@@ -109,19 +128,6 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
          "<img />",
      ],
      name: "img_onerror"},
-    {input: "<img src=javascript:alert(&quot;XSS&quot;)>",
-     acceptable: [
-         "<img src=\"javascript:void(0);\">",
-         "<img src=\"about:invalid#zGoSafez\"/>",
-         "<img src=\"about:invalid#zCSafez\">",
-         "<img>",
-         "<img />",
-         "<img src=\"about:invalid#zCSafez\" />",
-         "<img src=\"unsafe:javascript:alert(&#34;XSS&#34;)\">",
-         "<img src=\"about:invalid#zTSz\" />",
-         "<img src=\"about:invalid#zClosurez\" />",
-     ],
-     name: "img_quot"},
     {input: "<style><img src=\"</style><img src=x onerror=alert('xss')//\">",
      acceptable: [
          "",
@@ -133,19 +139,6 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
          "<img src=\"javascript:void(0);\">",
      ],
      name: "img_style"},
-    {input: "<img src=\"jav&#x09;ascript:alert('xss');\">",
-     acceptable: [
-         "<img src=\"javascript:void(0);\">",
-         "<img src=\"about:invalid#zGoSafez\"/>",
-         "<img src=\"about:invalid#zCSafez\">",
-         "<img src=\"about:invalid#zCSafez\" />",
-         "<img>",
-         "<img />",
-         "<img src=\"unsafe:jav&#9;ascript:alert('xss');\">",
-         "<img src=\"about:invalid#zTSz\" />",
-         "<img src=\"about:invalid#zClosurez\" />",
-     ],
-     name: "img_tab"},
     {input: "<input type=\"image\" src=\"javascript:alert('xss');\">",
      acceptable: [
          "",
@@ -278,17 +271,14 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
          "",
      ],
      name: "svg"},
-    {input: "<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>",
+    {input: "<a src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>foo</a>",
      acceptable: [
-         "<img src=\"javascript:void(0);\">",
-         "<img src=\"about:invalid#zGoSafez\"/>",
-         "<img src=\"about:invalid#zCSafez\">",
-         "<img>",
-         "<img />",
-         "<img src=\"about:invalid#zCSafez\" />",
-         "<img src=\"unsafe:javascript:alert('XSS')\">",
-         "<img src=\"about:invalid#zTSz\" />",
-         "<img src=\"about:invalid#zClosurez\" />",
+         "<a src=\"javascript:void(0);\">foo</a>",
+         "<a src=\"about:invalid#zGoSafez\">foo</a>",
+         "<a src=\"about:invalid#zCSafez\">foo</a>",
+         "<a src=\"unsafe:javascript:alert('XSS')\">foo</a>",
+         "<a src=\"about:invalid#zTSz\" />foo</a>",
+         "<a>foo</a>",
      ],
      name: "unicode"},
     {input: "<html></html>",
@@ -7939,20 +7929,6 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
          "<table><source><td></td></table>",
      ],
      name: "contract_source_scriptinside"},
-    {input: "<source src=\"javascript:xss\">",
-     acceptable: [
-         "<source src=\"unsafe:javascript:xss\"></source>",
-         "<source src=\"unsafe:javascript:xss\">",
-         "<source src=\"unsafe:javascript:xss\"/>",
-         "<source></source>",
-         "<source>",
-         "<source/>",
-         "<source />",
-         "<span></span>",
-         "<span />",
-         "",
-     ],
-     name: "contract_source_src"},
     {input: "<source srcdoc=\"x\">",
      acceptable: [
          "<source></source>",
@@ -8057,20 +8033,6 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
          "<table><img><td></td></table>",
      ],
      name: "contract_img_scriptinside"},
-    {input: "<img src=\"javascript:xss\">",
-     acceptable: [
-         "<img src=\"unsafe:javascript:xss\"></img>",
-         "<img src=\"unsafe:javascript:xss\">",
-         "<img src=\"unsafe:javascript:xss\"/>",
-         "<img></img>",
-         "<img>",
-         "<img/>",
-         "<img />",
-         "<span></span>",
-         "<span />",
-         "",
-     ],
-     name: "contract_img_src"},
     {input: "<img srcdoc=\"x\">",
      acceptable: [
          "<img></img>",
@@ -8540,20 +8502,6 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
          "<table><td></td></table>",
      ],
      name: "contract_video_scriptinside"},
-    {input: "<video src=\"javascript:xss\">",
-     acceptable: [
-         "<video src=\"unsafe:javascript:xss\"></video>",
-         "<video src=\"unsafe:javascript:xss\">",
-         "<video src=\"unsafe:javascript:xss\"/>",
-         "<video></video>",
-         "<video>",
-         "<video/>",
-         "<video />",
-         "<span></span>",
-         "<span />",
-         "",
-     ],
-     name: "contract_video_src"},
     {input: "<video srcdoc=\"x\">",
      acceptable: [
          "<video></video>",
@@ -8658,20 +8606,6 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
          "<table><td></td></table>",
      ],
      name: "contract_audio_scriptinside"},
-    {input: "<audio src=\"javascript:xss\">",
-     acceptable: [
-         "<audio src=\"unsafe:javascript:xss\"></audio>",
-         "<audio src=\"unsafe:javascript:xss\">",
-         "<audio src=\"unsafe:javascript:xss\"/>",
-         "<audio></audio>",
-         "<audio>",
-         "<audio/>",
-         "<audio />",
-         "<span></span>",
-         "<span />",
-         "",
-     ],
-     name: "contract_audio_src"},
     {input: "<audio srcdoc=\"x\">",
      acceptable: [
          "<audio></audio>",
