search

flavorjones / loofah

Ruby library for HTML/XML transformation and sanitization
MIT License
934 stars 137 forks source link

Block MathML mutation XSS #193

Closed DanielHeath closed 4 years ago

DanielHeath commented 4 years ago

Just tested this against the latest loofah version and got an alert(1).

https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/

DanielHeath commented 4 years ago

Argh! My mistake - loofah does in fact handle this (good job!)