Skip to content

Commit

Permalink
fix: Added __depth field to sanitized DOM nodes for better tracking
Browse files Browse the repository at this point in the history 
test: Added tests to cover possible nesting-based mXSS on Blink & Webkit
  • Loading branch information
@cure53
cure53 committed Apr 24, 2024
1 parent f051738 commit ce799c3
Show file tree
Hide file tree
Showing 10 changed files with 116 additions and 57 deletions.
28 changes: 15 additions & 13 deletions dist/purify.cjs.js
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion dist/purify.cjs.js.map
View file

Large diffs are not rendered by default.

28 changes: 15 additions & 13 deletions dist/purify.es.mjs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -928,7 +928,9 @@ function createDOMPurify() {
* @return {Boolean} true if clobbered, false if safe
*/
const _isClobbered = function _isClobbered(elm) {
return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
return elm instanceof HTMLFormElement && (
// eslint-disable-next-line unicorn/no-typeof-undefined
typeof elm.__depth !== 'undefined' && typeof elm.__depth !== 'number' || typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
};

/**
Expand Down Expand Up @@ -1286,7 +1288,6 @@ function createDOMPurify() {
let importedNode = null;
let currentNode = null;
let returnNode = null;
let depth = 0;
/* Make sure we have a string to sanitize.
DO NOT return early, as this will return the wrong type if
the user has requested a DOM object rather than a string */
Expand Down Expand Up @@ -1373,25 +1374,26 @@ function createDOMPurify() {

/* Now start iterating over the created document */
while (currentNode = nodeIterator.nextNode()) {
/* Sanitize tags and elements */
if (_sanitizeElements(currentNode)) {
continue;
}

/* Count the nesting depth of an element */
if (currentNode.nodeType === 1 && currentNode.hasChildNodes()) {
if (currentNode.hasChildNodes()) {
depth++;
/* Set the nesting depth of an element */
if (currentNode.nodeType === 1) {
// eslint-disable-next-line unicorn/prefer-ternary
if (currentNode.parentNode && currentNode.parentNode.__depth) {
currentNode.__depth = currentNode.parentNode.__depth + 1;
} else {
depth--;
currentNode.__depth = 1;
}
}

/* Remove an element if nested too deeply to avoid mXSS */
if (depth > MAX_NESTING_DEPTH) {
if (currentNode.__depth >= MAX_NESTING_DEPTH) {
_forceRemove(currentNode);
}

/* Sanitize tags and elements */
if (_sanitizeElements(currentNode)) {
continue;
}

/* Shadow DOM detected, sanitize it */
if (currentNode.content instanceof DocumentFragment) {
_sanitizeShadowDOM(currentNode.content);
Expand Down
2 changes: 1 addition & 1 deletion dist/purify.es.mjs.map
View file

Large diffs are not rendered by default.

28 changes: 15 additions & 13 deletions dist/purify.js
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion dist/purify.js.map
View file

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/purify.min.js
View file

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/purify.min.js.map
View file

Large diffs are not rendered by default.

29 changes: 16 additions & 13 deletions src/purify.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -937,7 +937,10 @@ function createDOMPurify(window = getGlobal()) {
const _isClobbered = function (elm) {
return (
elm instanceof HTMLFormElement &&
(typeof elm.nodeName !== 'string' ||
// eslint-disable-next-line unicorn/no-typeof-undefined
((typeof elm.__depth !== 'undefined' &&
typeof elm.__depth !== 'number') ||
typeof elm.nodeName !== 'string' ||
typeof elm.textContent !== 'string' ||
typeof elm.removeChild !== 'function' ||
!(elm.attributes instanceof NamedNodeMap) ||
Expand Down Expand Up @@ -1400,7 +1403,6 @@ function createDOMPurify(window = getGlobal()) {
let importedNode = null;
let currentNode = null;
let returnNode = null;
let depth = 0;
/* Make sure we have a string to sanitize.
DO NOT return early, as this will return the wrong type if
the user has requested a DOM object rather than a string */
Expand Down Expand Up @@ -1496,25 +1498,26 @@ function createDOMPurify(window = getGlobal()) {

/* Now start iterating over the created document */
while ((currentNode = nodeIterator.nextNode())) {
/* Sanitize tags and elements */
if (_sanitizeElements(currentNode)) {
continue;
}

/* Count the nesting depth of an element */
if (currentNode.nodeType === 1 && currentNode.hasChildNodes()) {
if (currentNode.hasChildNodes()) {
depth++;
/* Set the nesting depth of an element */
if (currentNode.nodeType === 1) {
// eslint-disable-next-line unicorn/prefer-ternary
if (currentNode.parentNode && currentNode.parentNode.__depth) {
currentNode.__depth = currentNode.parentNode.__depth + 1;
} else {
depth--;
currentNode.__depth = 1;
}
}

/* Remove an element if nested too deeply to avoid mXSS */
if (depth > MAX_NESTING_DEPTH) {
if (currentNode.__depth >= MAX_NESTING_DEPTH) {
_forceRemove(currentNode);
}

/* Sanitize tags and elements */
if (_sanitizeElements(currentNode)) {
continue;
}

/* Shadow DOM detected, sanitize it */
if (currentNode.content instanceof DocumentFragment) {
_sanitizeShadowDOM(currentNode.content);
Expand Down
50 changes: 50 additions & 0 deletions test/test-suite.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2104,5 +2104,55 @@
let clean = DOMPurify.sanitize(dirty, config);
assert.contains(clean, expected);
});

QUnit.test('Test proper handling of nesting-based mXSS 1/3', function (assert) {

let dirty = `${`<div>`.repeat(509)}${`</div>`.repeat(509)}<img>`;
let expected = `${`<div>`.repeat(509)}${`</div>`.repeat(509)}<img>`;
let clean = DOMPurify.sanitize(dirty);
assert.contains(clean, expected);

dirty = `${`<div>`.repeat(510)}${`</div>`.repeat(510)}<img>`;
expected = `${`<div>`.repeat(510)}${`</div>`.repeat(510)}<img>`;
clean = DOMPurify.sanitize(dirty);
assert.contains(clean, expected);

dirty = `${`<div>`.repeat(511)}${`</div>`.repeat(511)}<img>`;
expected = `${`<div>`.repeat(510)}${`</div>`.repeat(510)}<img>`;
clean = DOMPurify.sanitize(dirty);
assert.contains(clean, expected);

dirty = `${`<div>`.repeat(512)}${`</div>`.repeat(512)}<img>`;
expected = `${`<div>`.repeat(510)}${`</div>`.repeat(510)}<img>`;
clean = DOMPurify.sanitize(dirty);
assert.contains(clean, expected);
});

QUnit.test('Test proper handling of nesting-based mXSS 2/3', function (assert) {

let dirty = `<form><input name="__depth">${`<div>`.repeat(509)}${`</div>`.repeat(509)}<img>`;
let expected = [
``,
`<form><input name="__depth">${`<div>`.repeat(509)}${`</div>`.repeat(509)}<img></form>`,
];
let clean = DOMPurify.sanitize(dirty);
assert.contains(clean, expected);

dirty = `<form><input name="__depth"></form>${`<div>`.repeat(509)}${`</div>`.repeat(509)}<img>`;
expected = [
`${`<div>`.repeat(509)}${`</div>`.repeat(509)}<img>`,
`<form><input name="__depth"></form>${`<div>`.repeat(509)}${`</div>`.repeat(509)}<img>`
];
clean = DOMPurify.sanitize(dirty);
assert.contains(clean, expected);
});

QUnit.test('Test proper handling of nesting-based mXSS 3/3', function (assert) {

let dirty = `<form><input name="__depth">`;
let expected = [``, `<form><input name="__depth"></form>`];
let clean = DOMPurify.sanitize(dirty);
assert.contains(clean, expected);
});
};
});

0 comments on commit ce799c3

Please sign in to comment.