GHSA-vcc4-2c75-vc9v Caddy: stripHTML template function bypass

• Go github.com/caddyserver/caddy/v2: < 2.11.4 → fixed in 2.11.4 • Go github.com/caddyserver/caddy: <= 1.0.5 (no fix yet)

Summary Caddy’s `stripHTML` template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as `img src=x onerror=alert()>`, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. --- Details The vulnerability originates from `funcStripHTML` in: caddy/caddy/caddyhttp/templates/tplcontext.go ```go func (TemplateContext) funcStripHTML(s string) string { var buf bytes.Buffer var inTag, inQuotes bool var tagStart int for i, ch := range s { if inTag { if ch == '>' && !inQuotes { inTag = false } else if ch == ' StripHTML Bypass Test {{ stripHTML "img src=x onerror=alert('XSS')>" }} ``` The payload exploits the false start branch to smuggle a literal to terminate the parser’s tag state, leaving a valid tag behind. Tested in v2.11.3 Impact Malformed HTML can bypass stripHTML, potentially allowing arbitrary HTML or JavaScript to be rendered if the output is used unsafely, leading to client-side XSS. AI Disclosure AI assisted in writing the report description; however, the discovery of the issue has been done manually.