Advisories for Gem/Rails-Html-Sanitizer package

2024
2022

Inefficient Regular Expression Complexity

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.

Duplicate of ./gem/rails-html-sanitizer/CVE-2022-23518.yml

Summary rails-html-sanitizer >= 1.0.3, < 1.4.4 is vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. Mitigation Upgrade to rails-html-sanitizer >= 1.4.4. Severity The maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#. References CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9) SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg https://github.com/rails/rails-html-sanitizer/issues/135 https://hackerone.com/reports/1694173 Credit This …

Duplicate of ./gem/rails-html-sanitizer/CVE-2022-23517.yml

Summary Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. Mitigation Upgrade to rails-html-sanitizer >= 1.4.4. Severity The maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#. References CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9) https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly reported …

2018

XSS vulnerability

The gem allows attributes that are not specified in the allowlist to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah.

2016

XSS vulnerability in strip_tags

Due to the way that Rails::Html::FullSanitizer is implemented, if an attacker passes an already escaped HTML entity to the input of Action View's strip_tags these entities will be unescaped what may cause a XSS attack if used in combination with raw or html_safe.