mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.55k stars 200 forks source link

Sanitizer crashes if a style string specifies 191 fields #272

Closed rgoodman77 closed 3 years ago

rgoodman77 commented 3 years ago

This is weird and was not contrived to break the sanitizer, but an HTML string containing this code crashes the sanitizer.

<span class="TextRun  BCX9 SCXW163788243" lang="EN-US" lang="EN-US" style='background: rgba(0, 0, 0, 0); list-style: decimal; margin: 0px; padding: 0px; outline: rgb(0, 0, 0) 0px; transform-origin: 0px 0px; perspective-origin: 0px 0px; columns: auto auto; column-rule: 0px rgb(0, 0, 0); border-radius: 0px; border: 0px rgb(0, 0, 0); transition:all; flex:0 1 auto; border-image: none; left: auto; top: auto; width: auto; height: auto; text-align: left; right: auto; bottom: auto; text-transform: none; line-height: 29.13px; text-indent: 0px; letter-spacing: normal; overflow: visible; clear: none; font-style: normal; font-weight: 400; word-spacing: 0px; vertical-align: baseline; float: none; display: inline; white-space: normal; visibility: visible; filter: none; border-collapse: separate; position: static; z-index: auto; clip: auto; table-layout: auto; cursor: text; unicode-bidi: normal; direction: ltr; -ms-word-break: normal; -ms-zoom: 1; -ms-text-underline-position: auto; -ms-text-align-last: auto; -ms-text-overflow: clip; min-height: 0px; max-height: none; min-width: 0px; max-width: none; content: normal; caption-side: top; box-sizing: content-box; border-spacing: 0px; orphans: 2; widows: 2; empty-cells: show; alignment-baseline: auto; baseline-shift: 0px; dominant-baseline: auto; opacity: 1; clip-path: none; clip-rule: nonzero; fill: rgb(0, 0, 0); fill-opacity: 1; fill-rule: nonzero; marker-end: none; marker-mid: none; marker-start: none; mask: none; pointer-events: auto; stop-color: rgb(0, 0, 0); stop-opacity: 1; stroke: none; stroke-dasharray: none; stroke-dashoffset: 0px; stroke-linecap: butt; stroke-linejoin: miter; stroke-miterlimit: 4; stroke-opacity: 1; stroke-width: 1.5px; text-anchor: start; box-shadow: none; column-span: none; break-before: auto; break-after: auto; break-inside: auto; flood-color: rgb(0, 0, 0); flood-opacity: 1; color-interpolation-filters: linearRGB; lighting-color: rgb(255, 255, 255); text-shadow: none; transform: none; perspective: none; transform-style: flat; backface-visibility: visible; order: 0; touch-action: auto; user-select: text; -webkit-user-drag: none; -webkit-tap-highlight-color: rgba(0, 0, 0, 0); overflow-wrap: break-word; font-kerning: none; background-blend-mode: normal; font-optical-sizing: auto; image-rendering: auto; isolation: auto; place-items: normal; place-self: auto; mix-blend-mode: normal; object-fit: fill; object-position: 50% 50%; offset: none 0px auto 0deg; outline-offset: 0px; overflow-anchor: auto; resize: none; scroll-behavior: auto; speak: normal; tab-size: 8; text-decoration-skip-ink: auto; text-rendering: auto; text-size-adjust: auto; will-change: auto; -webkit-appearance: none; -webkit-border-image: none; -webkit-box-align: stretch; -webkit-box-decoration-break: slice; -webkit-box-direction: normal; -webkit-box-flex: 0; -webkit-box-ordinal-group: 1; -webkit-box-orient: horizontal; -webkit-box-pack: start; gap: normal; backdrop-filter: none; place-content: normal; -webkit-font-smoothing: auto; grid-auto-columns: auto; grid-auto-flow: row; grid-auto-rows: auto; grid-area: auto /auto /auto /auto; grid-template-areas: none; grid-template-columns: none; grid-template-rows: none; -webkit-highlight: none; hyphens: manual; -webkit-hyphenate-character: auto; -webkit-line-break: after-white-space; -webkit-locale: "en-US"; -webkit-margin-collapse: collapse collapse; -webkit-mask-box-image-outset: 0px; -webkit-mask-box-image-repeat: stretch; -webkit-mask-box-image-slice: 0 fill; -webkit-mask-box-image-source: none; -webkit-mask-box-image-width: auto; -webkit-mask: none 0% 0% /auto repeat border-box border-box; -webkit-mask-composite: source-over; -webkit-print-color-adjust: economy; -webkit-rtl-ordering: logical; shape-outside: none; shape-image-threshold: 0; shape-margin: 0px; -webkit-text-combine: none; -webkit-text-decorations-in-effect: none; -webkit-text-emphasis: none rgb(0, 0, 0); -webkit-text-emphasis-position: over right; -webkit-text-fill-color: rgb(0, 0, 0); -webkit-text-orientation: vertical-right; -webkit-text-security: none; -webkit-text-stroke: 0px rgb(0, 0, 0); -webkit-user-modify: read-write; -webkit-writing-mode: horizontal-tb; -webkit-app-region: none; buffered-rendering: auto; color-interpolation: srgb; color-rendering: auto; mask-type: luminance; shape-rendering: auto; vector-effect: none; paint-order: normal; d: none; cx: 0px; cy: 0px; x: 0px; y: 0px; r: 0px; rx: auto; ry: auto; caret-color: rgb(0, 0, 0);' xml:lang="EN-US" data-contrast="auto">
tiesont commented 3 years ago

If your issue contains HTML, you'll need to use a code block for it to show up. That's the <> button on the toolbar, or surround your code with three backticks. So (minus the backslash):

\```
Your code
\```
mganss commented 3 years ago

For syntax highlighting use html after the triple backticks:

```html
<div>

@tiesont TIL you can also use `markdown` code blocks within Markdown. I used quadruple backticks but there are probably other ways, too. So for the above I used (now using quintuple backticks 🤯):

`````markdown
````markdown
```html
<div>
mganss commented 3 years ago

It boils down to this:

<span style="grid-template-areas: none; grid-template-columns: none; grid-template-rows: none">

This is an issue within AngleSharp.Css. I've opened https://github.com/AngleSharp/AngleSharp.Css/issues/68.

rgoodman77 commented 3 years ago

Thanks for the quick turnaround.