URL XSS issue

[panec]

In the xss_api.js there is a function for sanitize URL which does not allow for not correct URL to be rendered.

function sanitizeURL(url) {
  try {
    const decodedUrl = decodeURIComponent(url);

    if (XRegExp(RELATIVE_REF).test(decodedUrl) || XRegExp(URI).test(decodedUrl)) {
      return url;
    }
  } catch (e) {
    // ignore
  }
  return '';
}

What is is odd for me is the way it is constructed.

The following URL
https://via.placeholder.com/1280x550&text=desktop%201280x550
is marked as invalid.

The problematic part is an escaped space character %20. Because its escaped version looks like this:
https://via.placeholder.com/1280x550&text=desktop 1280x550
which is not a valid URL

To make this valid you need to double escape the space %20 -> %2520:
https://via.placeholder.com/1280x550&text=desktop%25201280x550

Why the test function decodes the url before checking if it is a valid URI?

[panec]

Additional tiny improvement might be added by updating format_xss.js function of

function isUriAttribute(name) {
  return name === 'href' || name === 'src';
}

into

function isUriAttribute(name) {
  return name === 'href' || name === 'src' || name === 'srcset';
}

as I believe that srcset always needs to be an URI

[tripodsan]

as I believe that srcset always needs to be an URI

it's a bit more complicated: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/source#attr-srcset

[adobe-bot]

🎉 This issue has been resolved in version 4.5.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀