Comments (8)
Hmmm, not sure if I fully understand the question 🙂
Does this only happen with style elements inside SVG or also inside HTML? If only for SVG, I would strongly assume that the browser treats style inside SVG as a XSS sink:
<svg>
<style><script>alert(1)</script></style>
</svg>
from dompurify.
Hmmm, not sure if I fully understand the question 🙂
Does this only happen with style elements inside SVG or also inside HTML? If only for SVG, I would strongly assume that the browser treats style inside SVG as a XSS sink:
<svg> <style><script>alert(1)</script></style> </svg>
Yes exactly, but whenever I call sanitize, it does throw the error shown above (see the stacktrace starts at sanitize). I don't understand why this throws an error?
from dompurify.
That I don't know either :) Can you spin up a test case so we can have a look at it?
from dompurify.
![image](https://private-user-images.githubusercontent.com/13659466/295528421-1d83920e-8a46-45c1-9c6a-968d901d3456.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTc2ODIyNTAsIm5iZiI6MTcxNzY4MTk1MCwicGF0aCI6Ii8xMzY1OTQ2Ni8yOTU1Mjg0MjEtMWQ4MzkyMGUtOGE0Ni00NWMxLTljNmEtOTY4ZDkwMWQzNDU2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA2MDYlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNjA2VDEzNTIzMFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWJkMTg4ZDA5MzA4YTkzM2E1MmNkY2U0YTcyOTVkZDkwYjkwMjVmYjJhMTRiZGRmZTY4MDdiZTEyYTI3MGY4NmUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.TUmpj0oEG1QtSDr8WcEwXcKFPWXNRdpJsY3BYjo7Zlo)
I created a small reproduction: https://gist.github.com/timonmasberg/d87cb5bd320d7443cab803e1a4aeed05
Thanks once again for your help!
from dompurify.
Thanks for making this available.
I am a bit confused because I am not sure how the error in fact relates to Trusted Types and not simply CSP. What I get is a CSP error complaining about the usage if inline CSS.
Could you explain further how this might be a TT issue and not simply CSP complaining about inline CSS?
from dompurify.
Thanks for making this available.
I am a bit confused because I am not sure how the error in fact relates to Trusted Types and not simply CSP. What I get is a CSP error complaining about the usage if inline CSS.
Could you explain further how this might be a TT issue and not simply CSP complaining about inline CSS?
Yes sorry, ofc it is not a TT error, i was referring to it being thrown inside of the policy. Sorry for the misunderstanding. But what I still don't understand is, why the error is thrown inside of DOMPurify? Shouldn't it strip away the style tag complete (at least when using forbidden tags option)? Because for me the only fix is to "pre-sanitize" the string and pass it into DOMPurify. I would expect that this is also something done by the library.
from dompurify.
So, I think it's a plain CSP error message that only appears to show on Chrome (and other browsers with the same engine) but doesn't show on Firefox, for example - as my testing showed.
Googling this a bit seems to indicate that others have the same issue with Chrome being a bit overcritical here. Or Firefox not being critical enough, depending on the viewpoint 🙂
I think this is not a DOMPurify issue or anything we can actually fix. You could fix it by relaxing the CSP for CSS maybe?
from dompurify.
So, I think it's a plain CSP error message that only appears to show on Chrome (and other browsers with the same engine) but doesn't show on Firefox, for example - as my testing showed.
Googling this a bit seems to indicate that others have the same issue with Chrome being a bit overcritical here. Or Firefox not being critical enough, depending on the viewpoint 🙂
I think this is not a DOMPurify issue or anything we can actually fix. You could fix it by relaxing the CSP for CSS maybe?
Hm relaxing CSP would mean allowing all inline scripts. I just thought that DOMPurify would be able to handle this and strip everything away, but it appears that Chrome doesn't even like that. I guess i stick to "pre-"sanitizing it by removing the style tag myself...
Thanks
from dompurify.
Related Issues (20)
- New release v3.1.0 (not in releases) HOT 1
- How do I use the API provided by DomPurify to verify the SVG file is it risky? HOT 1
- Sanitize returns empty string when PARSER_MEDIA_TYPE: application/xhtml+xml and void tags HOT 4
- DOMPurify and Trusted Types - Clarification to Docs HOT 9
- when using bypasssecurityTrustHtml mthod to render template HOT 3
- Exception when passing 0 or "" or null to Dompurify.Sanitize Method HOT 2
- Use lower case for bower package name HOT 1
- Uncertain how to handle 'non-standard' HTML HOT 3
- Need to block external calls, e.g. all HTTP requests HOT 7
- Why does name="name" on an input field get purified? HOT 1
- Exception when passing 0 or "" or null to Dompurify.Sanitize Method #947 HOT 3
- Latest versions of DOMPurify 2.5.x block custom SVG elements when they are set via ADD_TAGS config. HOT 6
- release 3.1.3 assets are the same as 3.1.2 HOT 1
- Number.isNaN is not supported in MSIE HOT 15
- Bower issues : DOMPurify is not defined HOT 5
- HTML and BODY tags are being regardless of `ALLOWED_TAGS` settings HOT 2
- MAX_NESTING_DEPTH remove contents issue HOT 5
- Escape unsafe characters instead of removing them HOT 3
- The MAX_NESTING_DEPTH remove contents issue has not been resolved. HOT 3
- A code comment containing a tag name structure leads to removal of the entire block HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dompurify.