Skip to content

Commit d1223a2

Browse files
committed
fix: use Loofah's scrub_uri_attribute method
which correctly sanitizes data URL mediatypes
1 parent f0e3347 commit d1223a2

File tree

2 files changed

+51
-5
lines changed

2 files changed

+51
-5
lines changed

lib/rails/html/scrubbers.rb

+1-5
Original file line numberDiff line numberDiff line change
@@ -139,11 +139,7 @@ def scrub_attribute(node, attr_node)
139139
end
140140

141141
if Loofah::HTML5::SafeList::ATTR_VAL_IS_URI.include?(attr_name)
142-
# this block lifted nearly verbatim from HTML5 sanitization
143-
val_unescaped = CGI.unescapeHTML(attr_node.value).gsub(Loofah::HTML5::Scrub::CONTROL_CHARACTERS,'').downcase
144-
if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ && ! Loofah::HTML5::SafeList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR)[0])
145-
attr_node.remove
146-
end
142+
return if Loofah::HTML5::Scrub.scrub_uri_attribute(attr_node)
147143
end
148144

149145
if Loofah::HTML5::SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)

test/sanitizer_test.rb

+50
Original file line numberDiff line numberDiff line change
@@ -600,6 +600,56 @@ def test_disallow_the_dangerous_safelist_combination_of_select_and_style
600600
refute_includes(sanitized, "style")
601601
end
602602

603+
%w[text/plain text/css image/png image/gif image/jpeg].each do |mediatype|
604+
define_method "test_mediatype_#{mediatype}_allowed" do
605+
input = %Q(<img src="data:#{mediatype};base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
606+
expected = input
607+
actual = safe_list_sanitize(input)
608+
assert_equal(expected, actual)
609+
610+
input = %Q(<img src="DATA:#{mediatype};base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
611+
expected = input
612+
actual = safe_list_sanitize(input)
613+
assert_equal(expected, actual)
614+
end
615+
end
616+
617+
def test_mediatype_text_html_disallowed
618+
input = %q(<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
619+
expected = %q(<img>)
620+
actual = safe_list_sanitize(input)
621+
assert_equal(expected, actual)
622+
623+
input = %q(<img src="DATA:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
624+
expected = %q(<img>)
625+
actual = safe_list_sanitize(input)
626+
assert_equal(expected, actual)
627+
end
628+
629+
def test_mediatype_image_svg_xml_disallowed
630+
input = %q(<img src="data:image/svg+xml;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
631+
expected = %q(<img>)
632+
actual = safe_list_sanitize(input)
633+
assert_equal(expected, actual)
634+
635+
input = %q(<img src="DATA:image/svg+xml;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
636+
expected = %q(<img>)
637+
actual = safe_list_sanitize(input)
638+
assert_equal(expected, actual)
639+
end
640+
641+
def test_mediatype_other_disallowed
642+
input = %q(<a href="data:foo;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">foo</a>)
643+
expected = %q(<a>foo</a>)
644+
actual = safe_list_sanitize(input)
645+
assert_equal(expected, actual)
646+
647+
input = %q(<a href="DATA:foo;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">foo</a>)
648+
expected = %q(<a>foo</a>)
649+
actual = safe_list_sanitize(input)
650+
assert_equal(expected, actual)
651+
end
652+
603653
def test_scrubbing_svg_attr_values_that_allow_ref
604654
input = %Q(<div fill="yellow url(http://bad.com/) #fff">hey</div>)
605655
expected = %Q(<div fill="yellow #fff">hey</div>)

0 commit comments

Comments
 (0)