GHSA-hhg7-c65m-h7ff Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)

• Packagist symfony/html-sanitizer: >= 6.1.0, < 6.4.40 → fixed in 6.4.40 • Packagist symfony/html-sanitizer: >= 7.0.0, < 7.4.12 → fixed in 7.4.12 • Packagist symfony/html-sanitizer: >= 8.0.0, < 8.0.12 → fixed in 8.0.12 • Packagist symfony/symfony: >= 6.1.0, < 6.4.40 → fixed in 6.4.40 • Packagist symfony/symfony: >= 7.0.0, < 7.4.12 → fixed in 7.4.12 • Packagist symfony/symfony: >= 8.0.0, < 8.0.12 → fixed in 8.0.12

Description `symfony/html-sanitizer` lets applications sanitise untrusted HTML. `UrlAttributeSanitizer` is the visitor responsible for validating URL-valued attributes and stripping dangerous schemes from them; it runs on every element regardless of configuration. Whether an attribute is *kept* is decided by the element/attribute allow-list; validating the *scheme* of a URL attribute is solely `UrlAttributeSanitizer`'s responsibility. `UrlAttributeSanitizer::getSupportedAttributes()` returned only `['src', 'href', 'lowsrc', 'background', 'ping']`. The HTML URL-valued attributes `action` (``), `formaction` (``, ``), `poster` (``) and `cite` (``, ``, ``, ``) were missing from that list, so `DomVisitor` never invoked scheme validation for them. As a result, when a configuration admits one of those attributes, a `javascript:` URI in it survived sanitisation. Conditions for exploitation `allowSafeElements()` is not affected: `` and the `formaction` attribute are both flagged unsafe in `W3CReference`, and `allowElement('form')` resets the element's attribute list. Reaching the vulnerable attributes requires a deliberately permissive configuration, for example: • `` + `action`: `allowElement('form', '*')`, `allowElement('form', ['action', …])`, `allowElement('form')->allowAttribute('action', 'form')`, or the `allowStaticElements()` preset (whose docblock already warns the output "may still contain other dangerous behaviors"); • `` / `` + `formaction`: `allowElement(…, '*')`, `allowAttribute('formaction', …)`, or `allowStaticElements()`; • `` / `` / `` / `` + `cite`, or `` + `poster`: similarly via `'*'`, `allowAttribute()`, or `allowStaticElements()`. For the `action` / `formaction` cases the victim must additionally submit the form or click the button. Resolution `UrlAttributeSanitizer` now also handles `action`, `formaction`, `cite` and `poster`. `action` / `formaction` / `cite` are validated against the link schemes (like ``, so `javascript:` is rejected and `data:` is dropped too); `poster` is validated against the media schemes (so `data:` images keep working). The behaviour of `` and `` is unchanged. One behaviour change to be aware of: a relative `action="/submit"` on an allowed `` is now dropped by default (the same as `` / `` today); `->allowRelativeLinks()` re-enables it. The patch for this issue is available here for branch 6.4. Credits Symfony would like to thank Himanshu Anand and Rémi Pelloux for reporting the issue and Nicolas Grekas for providing the fix.