html-purify
html-purify copied to clipboard
vulnerability found in auto double quoting feature.
<img src="x" id='" onerror="alert(1)' />
it's not vulnerable itself. but after purification, it becomes
<img src="x" id="" onerror="alert(1)" />
this boils down to the problem of always using double quote in html purifier since v1.0
https://github.com/yahoo/html-purify/blob/v1.0.0/src/html-purify.js#L66
reported here as recommended by @yukinying
cc @maditya
Root cause of such should be in https://github.com/yahoo/html-purify/blob/master/src/html-purify.js#L120
plus https://github.com/yahoo/html-purify/blob/master/src/html-purify.js#L113
Was this released in 1.1?
We have an open PR for this - https://github.com/yahoo/html-purify/pull/22 and will merge it soon.