fix: Re-added an mXSS check for old Chrome

cure53 · Sep 24, 2020 · aec12c4 · aec12c4
1 parent 4586294
commit aec12c4
Showing 10 changed files with 41 additions and 6 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.js b/dist/purify.es.js
diff --git a/dist/purify.es.js.map b/dist/purify.es.js.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -840,6 +840,15 @@ function createDOMPurify(window = getGlobal()) {
         continue;
       }
 
+      /* Take care of an mXSS pattern using namespace switches */
+      if (
+        regExpTest(/svg|math/i, currentNode.namespaceURI) &&
+        regExpTest(/<\//, value)
+      ) {
+        _removeAttribute(name, currentNode);
+        continue;
+      }
+
       /* Sanitize attribute content to be template-safe */
       if (SAFE_FOR_TEMPLATES) {
         value = stringReplace(value, MUSTACHE_EXPR, ' ');

diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js
@@ -1005,7 +1005,7 @@ module.exports = [
           ""
       ]
   }, {
-      "title": "Tests against mXSS behavior with SVG in Chrome 77 and alike",
+      "title": "Tests against mXSS behavior with SVG in Chrome 77 and alike 1/2",
       "payload": "<svg></p><textarea><title><style></textarea><img src=x onerror=alert(1)></style></title></svg>",
       "expected": [
           "", 
@@ -1015,6 +1015,14 @@ module.exports = [
           "<svg xmlns=\"http://www.w3.org/2000/svg\"><p></p><textarea><title /></textarea></svg>",
           "<svg xmlns=\"http://www.w3.org/2000/svg\"><p></p><textarea></textarea></svg>"
       ]
+  }, {
+      "title": "Tests against mXSS behavior with SVG in Chrome 77 and alike 2/2",
+      "payload": "<svg></p><title><a id=\"</title><img src=x onerror=alert()>\"></textarea></svg>",
+      "expected": [
+          "",
+          "<svg><p></p><title><a id=\"</title><img src=x onerror=alert()>\"></a></title></svg>",
+          "<svg></svg><p></p><title>&lt;a id=\"</title><img src=\"x\">\"&gt;"
+      ]
   }, {
       "title": "Tests against mXSS behavior with MathML in Chrome 77 and alike",
       "payload": "<math></p><textarea><mi><style></textarea><img src=x onerror=alert(1)></mi></math>",