Emilstenstrom

Multiple low-severity denial-of-service issues exist in CSS selector handling and linkification. Applications may consume disproportionate CPU or memory when evaluating attacker-controlled selector strings via `query()`, `matches()`, or selector-based transforms, running selector matching over very large untrusted documents, constructing DOM trees from untrusted structure, or enabling linkification over attacker-controlled text. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These issues affect availability and do not allow script execution, data disclosure, or sanitizer bypass.

Security issues exist in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces like SVG or MathML, dangerous content such as HTML integration points (SVG `<foreignObject>`, MathML `<annotation-xml encoding="text/html">`) and mutation-XSS parser-differential payloads may survive sanitization and become active HTML after reparsing. Additionally, SVG `filter="url(...)"` and preserved `<style>` tags may allow resource-loading CSS via `@import` or `background-image:url()`. Programmatic script, style, or Comment nodes could serialize into active markup. Other issues include sanitize-pipeline cache mutation and DOM parent/child cycles that may lead to infinite loops. These issues primarily affect advanced or custom configurations rather than the default `JustHTML(..., sanitize=True)` path.

Multiple HTML sanitization bypass issues allow active or dangerous content, such as script or style tags, to survive the sanitization process, potentially leading to cross-site scripting. These issues primarily affect advanced usage scenarios rather than the default sanitization path. Technical causes include the mutation or reuse of sanitization policy objects, which can weaken subsequent sanitization. Additionally, programmatic DOM input provided to the `sanitize()` and `sanitize dom()` functions may fail to detect mixed-case tag names (e.g., `ScRiPt`, `StYlE`). Other vectors include crafted programmatic doctype names that serialize into active markup and custom policies preserving SVG or MathML that may allow animation elements, presentation attributes with external `url(...)` references, or DOM trees mislabeled as `namespace="html"` to bypass foreign-content checks.

Multiple security issues exist in URL sanitization helpers, HTML serialization, and Markdown passthrough. An attacker can bypass sanitization to inject active HTML and JavaScript through several methods: using encoded javascript: URLs, backslash-based relative URLs that resolve as remote hosts, programmatic element or attribute names that break markup, or HTML comments. Additionally, raw `</textarea>` tags can be reintroduced via Markdown passthrough when `html passthrough=True` is used. Certain custom policies may also preserve `<style>`, `<meta http-equiv=refresh>`, or `<base href>` tags. These issues primarily affect helper APIs, programmatic DOM construction, custom policies, transform pipelines, and configurations where `html passthrough=True` is enabled, rather than the default `sanitize=True` configuration. The affected helper functions include `clean url value()` and `clean url in js string()`.

A mutation cross-site scripting (mXSS) issue occurs when using a custom `SanitizationPolicy` that preserves foreign namespaces, such as setting `drop foreign namespaces=False` while allowlisting SVG/MathML elements or raw-text containers like `<style>`. This parser-differential flaw allows specially crafted input to be sanitized into markup that seems safe but becomes unsafe upon re-parsing by a browser or another HTML parser, leading to markup injection. The default safe configuration `sanitize=True` is not affected.