René Föhring

**Name of the Vulnerable Software and Affected Versions** html sanitize ex versions 0.3.1 through 1.5.2 **Description** An Open Redirect issue exists in the HTML5 scrubber where an unauthenticated remote attacker can retarget an existing form on a rendering page to capture submitted data, including credentials. This is achieved using the `form` and `formaction` attributes on an `<input>` element within sanitized HTML. The `form` attribute links an input to a form via its id, and the `formaction` attribute overrides the form's destination. Because these attributes lack scheme checks, absolute cross-origin URLs are not removed during sanitization. This attack requires the rendering page to already contain a form with an id, as the scrubber prevents the introduction of new form or button elements. **Recommendations** Update html sanitize ex to version 1.5.3 or later. As a temporary workaround, sanitize content using `basic html/1`, `markdown html/1`, or `strip tags/1`, or define a custom scrubber that omits the `<input>` element. Remove the `id` attribute from forms on the page or use unpredictable values for these IDs to prevent attackers from binding to them.

**Name of the Vulnerable Software and Affected Versions** html sanitize ex versions 0.3.1 through 1.5.2 **Description** An Open Redirect issue exists in the HTML5 scrubber of the software. A remote attacker can force visitors to navigate to an untrusted site by inserting a `<meta http-equiv="refresh">` element into sanitized HTML. This occurs because `HtmlSanitizeEx.html5/1` retains attacker-supplied `<meta>` elements in its output. Since a meta element affects the entire document rather than just the embedded fragment, it can also be used to declare document-wide directives, such as Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting and data injection attacks). **Recommendations** Update html sanitize ex to version 1.5.3 or later. As a temporary workaround, sanitize content using `basic html/1`, `markdown html/1`, or `strip tags/1`, as these do not allow meta elements. Alternatively, define a custom scrubber that omits the `<meta>` element.

**Name of the Vulnerable Software and Affected Versions** html sanitize ex versions 0.3.1 through 1.5.2 **Description** An Inclusion of Functionality from Untrusted Control Sphere issue exists in the HTML5 scrubber. A remote attacker can load an arbitrary document into a trusted page by utilizing the `data` attribute of an `<object>` element within sanitized HTML. This occurs because the `<object>` element in `lib/html sanitize ex/scrubber/html5.ex` was not registered through `allow tag with uri attributes/3` and only employs a lowercase prefix match for "javascript:". Consequently, data URIs, protocol-relative URLs, same-origin paths, and mixed-case variants are not properly filtered. While this does not lead to unconditional cross-site scripting, host-origin script execution is possible if the application serves attacker-controlled content from a same-origin path. **Recommendations** Update to version 1.5.3. As a temporary workaround, sanitize input using `basic html/1`, `markdown html/1`, or `strip tags/1`, or define a custom scrubber that omits the `<object>` element. Implement a Content-Security-Policy with `object-src 'none'` to block the loading of injected `<object>` elements. Host user uploads on a separate origin to remove the escalation path for script execution.

**Name of the Vulnerable Software and Affected Versions** html sanitize ex versions 0.3.1 through 1.5.3 **Description** An injection flaw exists in the CSS scrubber of the software, allowing an unauthenticated remote attacker to inject CSS at-rules, such as importing remote stylesheets, into pages served to other users. The `HtmlSanitizeEx.Scrubber.CSS.scrub/1` function uses a regular expression to apply allowlists to property and value declarations; however, input that does not match this specific pattern is not inspected and is passed to the output unchanged. This allows `@import` rules to bypass the scrubber. Because element boundaries are resolved before the scrubber executes, the injected content remains within the `<style>` element and cannot execute scripts. This issue specifically affects applications using `HtmlSanitizeEx.html5/1`, custom scrubbers extending `:html5` that permit `<style>` elements, or those calling `HtmlSanitizeEx.Scrubber.CSS.scrub/1` directly. **Recommendations** Update html sanitize ex to version 1.5.4 or later. Sanitize input using `basic html/1`, `markdown html/1`, or `strip tags/1`, as these do not allow `<style>` elements. Define a custom scrubber that omits the `<style>` element. Implement a Content-Security-Policy `style-src` directive that prohibits external stylesheet origins to prevent injected `@import` rules from loading.

**Name of the Vulnerable Software and Affected Versions** html sanitize ex versions 0.3.1 through 1.5.2 **Description** An unauthenticated remote attacker can cause server CPU exhaustion by providing a long CSS declaration within sanitized HTML. The issue resides in the `HtmlSanitizeEx.Scrubber.CSS.scrub/1` function, where a regular expression used to match property names employs an unbounded greedy `[-w]+` followed by a mandatory colon. When a long sequence of word characters is not followed by a colon, the engine performs quadratic work relative to the length of the run. This can saturate the BEAM scheduler pool, rendering the application unresponsive. This issue specifically affects `HtmlSanitizeEx.html5/1`, custom scrubbers using `HtmlSanitizeEx, extend: :html5`, and direct calls to `HtmlSanitizeEx.Scrubber.CSS.scrub/1` via style attributes or `<style>` element bodies. **Recommendations** Update html sanitize ex to version 1.5.3 or later. As a temporary workaround, sanitize input using `basic html/1`, `markdown html/1`, or `strip tags/1` to avoid the CSS scrubber. Define a custom scrubber that prohibits both style attributes and `<style>` elements. Implement a strict size limit on user-supplied HTML before it reaches the sanitizer to bound the processing cost.

**Name of the Vulnerable Software and Affected Versions** html sanitize ex versions 0.3.1 through 1.5.2 **Description** An inefficient algorithmic complexity issue exists in the traversal engine. An unauthenticated remote attacker can exhaust server CPU and memory by providing a flat run of sibling elements in sanitized HTML. The `HtmlSanitizeEx.Traverser.traverse/2` function recurses on the tail of a sibling list and evaluates `List.flatten([head] ++ tail)` over the already flattened result. This causes every sibling to copy and re-walk the entire remaining tail, resulting in quadratic traversal cost relative to the sibling count. This issue affects all public entry points and requires only allowed tags in the payload. For example, a 160 KB body containing 20,000 sibling elements can occupy a scheduler for approximately 1.7 seconds. **Recommendations** Update html sanitize ex to version 1.5.3 or later. Cap the size of user-supplied HTML, specifically the node count, before it reaches the sanitizer.