GHSA-x5qj-865h-mgvm Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

• Packagist symfony/html-sanitizer: >= 6.1.0, < 6.4.41 → fixed in 6.4.41 • Packagist symfony/html-sanitizer: >= 7.0.0, < 7.4.13 → fixed in 7.4.13 • Packagist symfony/html-sanitizer: >= 8.0.0, < 8.0.13 → fixed in 8.0.13 • Packagist symfony/symfony: >= 6.1.0, < 6.4.41 → fixed in 6.4.41 • Packagist symfony/symfony: >= 7.0.0, < 7.4.13 → fixed in 7.4.13 • Packagist symfony/symfony: >= 8.0.0, < 8.0.13 → fixed in 8.0.13

Description `Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme and host allow-lists, `javascript:` rejection, BiDi check, etc.). The list is `['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']`. Other URL-bearing attributes are absent: ``, ``, `` and ``, `` and ``. When an integrator opts these elements/attributes in via `allowElement('object', ['data'])`, `allowElement('applet', ['codebase'])`, etc., or via `allowAttribute()`, no URL sanitization runs: `data="javascript:alert(1)"` and similar payloads ship through unchanged into the output, enabling stored XSS. `` is the same class of bug routed differently: the URL is embedded inside a multi-field `content` attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable `` with the `content` attribute (e.g. via `allowStaticElements()`) see `content="0; url=javascript:alert(1)"` pass through, producing a refresh-driven navigation to a `javascript:` URL. Default configurations are not affected: ``, `` and `` are not in `W3CReference::BODY_ELEMENTS` and `` requires an explicit opt-in to `` context. The vulnerability surface is integrators who explicitly allow any of those elements together with the listed URL-bearing attributes. Resolution `UrlAttributeSanitizer` now also routes `data`, `codebase`, `archive` and `longdesc` through `UrlSanitizer::sanitize()`. A new `MetaRefreshAttributeSanitizer` registered as a default attribute sanitizer detects the `; url=` syntax inside ``, sanitizes the embedded URL, and drops the attribute if the URL is rejected; non-refresh meta `content` values are passed through unchanged. The patches for this issue are available here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1). Credits Symfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.