fix: Fixed a mXSS bypass reported in #482

cure53 · Nov 2, 2020 · ee33fae · ee33fae
1 parent e95b0de
commit ee33fae
Show file tree

Hide file tree

Showing 10 changed files with 19 additions and 12 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.js b/dist/purify.es.js
diff --git a/dist/purify.es.js.map b/dist/purify.es.js.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -651,7 +651,7 @@ function createDOMPurify(window = getGlobal()) {
     /* Take care of an mXSS pattern using p, br inside svg, math */
     if (
       (tagName === 'svg' || tagName === 'math') &&
-      currentNode.querySelectorAll('p, br').length !== 0
+      currentNode.querySelectorAll('p, br, form').length !== 0
     ) {
       _forceRemove(currentNode);
       return true;

diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js
@@ -1116,26 +1116,33 @@ module.exports = [
           "<svg></svg><b><style><b title='</style><img>'&gt;</b>"
       ]
   }, {
-      "title": "Tests against nesting-based mXSS behavior 1/3",
+      "title": "Tests against nesting-based mXSS behavior 1/4",
       "payload": "<form><math><mtext></form><form><mglyph><style><img src=x onerror=alert(1)>",
       "expected": [
           "<form></form>",
           "<form><math><mtext><form><mglyph></mglyph></form></mtext></math></form>"
       ]
   }, {
-      "title": "Tests against nesting-based mXSS behavior 2/3",
+      "title": "Tests against nesting-based mXSS behavior 2/4",
       "payload": "<math><mtext><table><mglyph><style><math href=javascript:alert(1)>CLICKME</math>",
       "expected": [
           "",
           "<math><mtext><mglyph></mglyph><table></table></mtext></math>"
       ]
   }, {
-      "title": "Tests against nesting-based mXSS behavior 3/3",
+      "title": "Tests against nesting-based mXSS behavior 3/4",
       "payload": "<math><mtext><table><mglyph><style><!--</style><img title=\"--&gt;&lt;img src=1 onerror=alert(1)&gt;\">",
       "expected": [
           "",
           "<math><mtext><mglyph><img title=\"--><img src=1 onerror=alert(1)>\"></mglyph><table></table></mtext></math>"
       ]
+  }, {
+      "title": "Tests against nesting-based mXSS behavior 4/4",
+      "payload": "<form><math><mtext></form><form><mglyph><svg><mtext><style><path id=\"</style><img onerror=alert(1) src>\">",
+      "expected": [
+          "",
+          "<form></form>"
+      ]
   }, {
       "title": "Tests against proper handling of leading whitespaces",
       "payload": " ",