GHSA-g9gq-3pfx-2gw2 — OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

Affected: Maven: com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer

### Summary It is observed that OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows `noscript` and `style` tags with `allowTextIn` inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy.

### Details

The OWASP java HTML sanitizer is vulnerable to XSS. This only happens when HtmlPolicyBuilder allows `noscript` & `style` tag with `allowTextIn` inside style tags.

The following condition is very edge case but if users combine a HtmlPolicyBuilder with any other tags except `noscript` and allow `style` tag with `allowTextIn` inside the style tag then In this case sanitizer would be safe from XSS. This happens because how the browser also perceives `noscript` tags post sanitization.

### PoC

1. Lets create a `HtmlPolicyBuilder` which allows `p, noscript, style` html tags and allows `.allowTextIn("style")`. 2. There are two XSS payloads which very identical and only difference is one has p tag and other has noscript tag. These payload have script tags that could be vulnerable to XSS and should be stripped out after sanitisation.

```HTML 1. <noscript><style></noscript><script>alert(1)</script> 2. <p><style></p><script>alert(1)</script> ```

3. Run the following piece of code which sanitizes the payload.

```java public class main { private static final String ALLOWED_HTML_TAGS = "p, noscript, style";

/** * Description of vulnerabil…

Most recent entries from all

GHSA-g9gq-3pfx-2gw2 — OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization