Unexpected WhiteListSanitizer behavior when allowed_attributes is set #27
Description
When sanitizing strings with WhiteListSanitizer, if neither allowed_attributes nor allowed_tags are set:
- all HTML comments are removed
- all
<script>and<form>tags are removed, including their contents
> t = '<p id="harmless_p" class="important_p"><script>alert("pwned!");</script>I am totally harmless :)</p><form action="/malicious.php"><!--you are pwned, friend --><input type="submit"></form>'
> sanitize t
=> "<p id=\"harmless_p\" class=\"important_p\">I am totally harmless :)</p>"
However if allowed_attributes is set:
- HTML comments are still removed
<script>tags are stripped, but their content remains in the document<form>tags and their contents are unaffected (except for attributes not present in theallowed_attributesarray, which are removed)
# in application.rb:
config.action_view.sanitized_allowed_attributes = ['id']
---
> t = '<p id="harmless_p" class="important_p"><script>alert("pwned!");</script>I am totally harmless :)</p><form action="/malicious.php"><!--you are pwned, friend --><input type="submit"></form>'
> sanitize t
=> "<p id=\"harmless_p\">alert(\"pwned!\");I am totally harmless :)</p><form><input></form>"
I think this is an undesirable behavior that will surprise users. If I set allowed_attributes, I expect it to affect only the behavior regarding attributes, and the behavior regarding tags to be unaffected.
I propose changing WhiteListSanitizer so that the stripping of <script> and <form> tags and their contents is done regardless of allowed_attributes and allowed_tags being set or not. If you agree I will submit a PR.