search

cure53 / DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
https://cure53.de/purify
Other
13.67k stars 698 forks source link

DOM Purify Allows onfocus events #982

Closed agonvuniqi closed 1 month ago

agonvuniqi commented 2 months ago

This issue proposes a [bug, feature] which...

Background & Context

onFocus is not properly handled

Bug

I can enter " onfocus="alert('=returnXSS')" and that will trigger alert method on my field as soon as I focus in.

Input

" onfocus="alert('=returnXSS')"

Given output

" onfocus="alert('=returnXSS')"

Expected output

The expected output.

I already have the config set up: DOMPurify.setConfig({ FORBID_TAGS: ['script', 'iframe', 'img', 'a', 'div', 'input', 'object', 'embed', 'form', 'svg', 'math'], FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover', 'onfocus', 'onblur', 'onchange', 'style', 'src', 'href'] });

cure53 commented 1 month ago

Nah, that is not a bypass and 100% expected behavior - the sanitizer sanitizes HTML, not strings that might get concatenated into existing HTML.