Should expose default values of ALLOWED_TAGS and ALLOWED_ATTR in DOMPurify object about dompurify

[cure53]

I am hesitant to do so as I think this introduces a security problem: In certain cases, an attacker might be able to use DOM Clobbering to overwrite those values and thereby enable white-listing of arbitrary elements and attributes.

I think the way it is right now is good enough - but might of course be convinced otherwise ;) For now I am reject and close the ticket, feel free to reopen if you have additional input.

[hyderali]

Then there should be some other easy way to add tags or attributes to the existing allowed values while sanitizing.

[cure53]

But why? I believe it's good enough to pass configuration parameters upon instantiation. Anything else is overhead imho and a security risk.

[hyderali]

Say I'm ok with the existing ALLOWED_ATTR and just want to add valign alone, and I don't want to give the entire attributes again, there isn't a way to give this as a configuration upon instantiation.

[cure53]

Ah, I get it. So here's what I am worried about:

If we allow to extend the existing configuration arrays and flag, we make them accessible from the outside. That means, anyone can edit them and influence them before DOMPurify.sanitize() is being called.

In the worst case, an attacker could for example overwrite properties using DOM clobbering and harmless-looking markup. Think for example <a href="#text,script,iframe" id="ALLOWED_TAGS"></a> (would require more stars to be aligned but might in fact work). In essence: I don't want to allow declarative change of the configuration properties.

What we could do is to implement a public setter method. That could be used to receive an array of additional properties, pass them on to sanitize() and merge them into the existing ones. We cannot call methods using DOM clobbering so that would be safe. Pull requests welcome :)

[hyderali]

What we could do is to implement a public setter method. That could be used to receive an array of additional properties, pass them on to sanitize() and merge them into the existing ones.

Yeah, this is what I meant to. But how should be the additional properties be passed, the same ALLOWED_ATTR with a merge flag or a new configuration ALLOWED_ADDITIONAL_ATTR (or something of this kind) ?

[cure53]

For example, yes - maybe a more compact wording but that should do the trick.

[cure53]

I am currently testing with the following code:

            /* Merge config parameters */
            cfg.ADD_ATTR ? ALLOWED_ATTR.concat(cfg.ADD_ATTR);
            cfg.ADD_TAGS ? ALLOWED_TAGS.concat(cfg.ADD_TAGS);

You can pass in an array of additional tags or attributes that will be merged into the existing ones. Does that meet the requirement?

[hyderali]

Yeah, that is great 👍 Thank you.