GitHub Advisoryadvisory · crates.io
GHSA-p2g9-94wh-65c2 Space bug in `clean_text`
MEDIUM
Official page ↗
- Ecosystem
- crates.io
- Packages
- ammonia
- Severity
- Moderate
- Weaknesses
- CWE-79
- Reviewed
- 2022-06-16
Affected packages
• crates.io ammonia: >= 3.0.0, < 3.1.3 → fixed in 3.1.3
Description
An incorrect mapping from HTML specification to ASCII codes was used.
Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
let html = format!("", clean_text(user_supplied_string));
Applications are not affected if they quote their attributes, or if they don't use `clean_text` at all.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness