GHSA-9jh8-v38h-cvhr ammonia: mXSS via MathML `annotation-xml` encoding strip

• crates.io ammonia: < 3.3.2 → fixed in 3.3.2 • crates.io ammonia: >= 4.0.0, < 4.0.2 → fixed in 4.0.2 • crates.io ammonia: >= 4.1.0, < 4.1.3 → fixed in 4.1.3

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The `annotation-xml` tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags. This vulnerability only has an effect when the `math` and `annotation-xml` tags are both enabled, but the `encoding` attribute is disabled, because it relies on the following sequence of steps: 1. User writes code like ``. 2. Namespace filtering checks the DOM, and it passes. `` is parsed as HTML. 3. Attribute filter strips it down to ``. Because the encoding attribute is gone, `` is now parsed as MathML. 4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML. Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These [elements] are: • title • textarea • xmp • iframe • noembed • noframes • plaintext • noscript • style • script Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default. [elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs Impact Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those. Patches • https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3) • https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2) • https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2) Workarounds Call builder.add_clean_content_tags("annotation-xml") to remove the annotation-xml element and all of its children, including the XSS gadget.