<img> xss vulnerability

cure53 / DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

https://cure53.de/purify

Other

13.34k stars 690 forks source link

<img> xss vulnerability #971

Closed Koleneko closed 4 weeks ago

Koleneko commented 1 month ago

This issue proposes a bug which...

Background & Context

Found following xss vulnerability that affects our production code

Bug

Yet another xss injection

Input

"><img src=x onerror=alert()>

Given output

Expected output

Cleaned input