GHSA-pg8v-g4xq-hww9

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-pg8v-g4xq-hww9/GHSA-pg8v-g4xq-hww9.json
Aliases
  • CVE-2022-32209
Published
2022-06-25T00:00:54Z
Modified
2022-09-20T03:36:05.195589Z
Details

Versions of Rails::Html::Sanitizer prior to version 1.4.3 are vulnerable to XSS with certain configurations of Rails::Html::Sanitizer which allows an attacker to inject content when the application developer has overridden the sanitizer's allowed tags to allow both select and style elements. Code is only impacted if allowed tags are being overridden.

This may be done via application configuration: ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]

see https://guides.rubyonrails.org/configuring.html#configuring-action-view

Or it may be done with a :tags option to the Action View helper sanitize: <%= sanitize @comment.body, tags: ["select", "style"] %>

see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize

It may also be done with Rails::Html::SafeListSanitizer directly: ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"] or with ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])

All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" are recommended to upgrade immediately. A workaround for this issue can be applied by removing either select or style from the overridden allowed tags.

References

Affected packages

RubyGems / rails-html-sanitizer

rails-html-sanitizer

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Fixed
1.4.3

Affected versions

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.4.0
1.4.1
1.4.2