GHSA-j92c-7v7g-gj3f HtmlSanitizer has a bypass via template tag

• NuGet HtmlSanitizer: < 9.0.892 → fixed in 9.0.892 • NuGet HtmlSanitizer: >= 9.1.878-beta, < 9.1.893-beta → fixed in 9.1.893-beta

Impact If the `template` tag is allowed, its contents are not sanitized. The `template` tag is a special tag that does not usually render its contents, unless the `shadowrootmode` attribute is set to `open` or `closed`. The lack of sanitization of the template tag brings up two bypasses: 1. it is still possible to forcibly render the contents of a `` tag through mutation XSS. The DOM parsers in browsers such as Chromium have a node depth limit of 512 and tags which are beyond that depth are flattened. This in turn allows elements within `` (which are not sanitized) to be effectively 'popped out'. An example would look like this: `[...]alert('xss')` where `[...]` denotes at least another 509 opening `` tags. 2. If in addition to the template tag, the `shadowrootmode` attribute is allowed through `sanitizer.AllowedAttributes.Add("shadowrootmode");`, the simple payload of `alert('xss')` would bypass the sanitizer. This is because such usage of `` attaches a shadow root to its parent: ``, and its contents will be rendered. Note that the default configuration is not affected because the `template` tag is disallowed by default. Patches The problem has been patched in versions 9.0.892 and 9.1.893-beta. Workarounds Disallow the `template` tag. It is disallowed by default. Resources https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template