GHSA-g7xq-xv8c-h98c Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

• RubyGems phlex: >= 1.10.0, < 1.10.1 → fixed in 1.10.1 • RubyGems phlex: >= 1.9.0, < 1.9.2 → fixed in 1.9.2 • RubyGems phlex: >= 1.8.0, < 1.8.3 → fixed in 1.8.3 • RubyGems phlex: >= 1.7.0, < 1.7.2 → fixed in 1.7.2 • RubyGems phlex: >= 1.6.0, < 1.6.3 → fixed in 1.6.3 • RubyGems phlex: >= 1.5.0, < 1.5.3 → fixed in 1.5.3 • RubyGems phlex: < 1.4.2 → fixed in 1.4.2

Summary There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. Our filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. Impact If you render an `` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. ```ruby a(href: user_profile) { "Profile" } ``` Mitigation The best way to mitigate this vulnerability is to update to one of the following versions: • 1.10.1 • 1.9.2 • 1.8.3 • 1.7.2 • 1.6.3 • 1.5.3 • 1.4.2 Workarounds Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.