Potential bug with content getting cut off, example with curly brackets / braces

[lukaszsobek]

This issue proposes a bug which...

Background & Context

When purifying a string with html + curly brackets the curly brackets get removed if there is a malicious element, but not if the string is clean.

Configuration: sanitize(potentiallyDirty, { RETURN_DOM: false });
version: 2.4.3

1.

Input:

<p>abc<iframe//src=jAva&Tab;script:alert(3)>def</p> {{"something":30,"somethingElse":22,"aString":"yes"}}
<a href="{{"something":30,"somethingElse":22,"aString":"yes"}}">something</a>

output: <p>abc</p>
expected:

<p>abc</p> {{"something":30,"somethingElse":22,"aString":"yes"}}
<a href="{{">something</a>

2.

Input:

<p>abc<iframe//src=jAva&Tab;script:alert(3)>def</p> {{'something':30,'somethingElse':22,'aString':'yes'}}
<a href="{{'something':30,'somethingElse':22,'aString':'yes'}}">something</a>

output: <p>abc</p> but script seems to get triggered
expected:

<p>abc</p> {{'something':30,'somethingElse':22,'aString':'yes'}}
<a href="{{'something':30,'somethingElse':22,'aString':'yes'}}">something</a>

3.

Input:

<p>abc</p> {{'something':30,'somethingElse':22,'aString':'yes'}}
<a href="{{'something':30,'somethingElse':22,'aString':'yes'}}">something</a>

output: same as input
expected: works as intended

4.

Input:

<p>abc</p> {{"something":30,"somethingElse":22,"aString":"yes"}}
<a href="{{"something":30,"somethingElse":22,"aString":"yes"}}">something</a>

output:

<p>abc</p> {{"something":30,"somethingElse":22,"aString":"yes"}}
<a href="{{">something</a>

expected: works as intended

[cure53]

The problem here is the Iframe :) It's not closed so everything "inside" is considered to be a part of it. So, it gets removed when the Iframe gets removed.

Example (where iframe is closed):

<p>abc<iframe//src=jAva&Tab;script:alert(3)></iframe>def</p> {{"something":30,"somethingElse":22,"aString":"yes"}}
<a href="{{"something":30,"somethingElse":22,"aString":"yes"}}">something</a>

[lukaszsobek]

What worries me is that in example 2 the script gets executed. The rest sounds perfectly reasonable :) Thank you for the quick clarification.

[cure53]

What do you mean, the JS URI?

[cure53]

I cannot reproduce any JavaScript execution - sorry. Tried the exact config and version.

If you have a clean repro, please let us know, closing this ticket for now.