sanitize.class.php htmlClean XSS Vulnerability Analysis and Fix

Key Vulnerability Information Summary Vulnerability Overview Commit Message: Issue Description: In the function, when performing schema checks on legacy attributes that carry URLs (such as and ), the protocol within URLs was not properly filtered or stripped, creating an XSS risk. Committer: abrookbanks, committed on June 8 Commit Hash: Scope of Impact Affected File: Affected Versions: v6.x-master (involving tags 6.8.0 and 6.7.5) Impact Target: The logic within the static function that handles and Fix Solution 1. Extend the array: Add attributes such as , , , , , , , , , and to the list of URL attributes. 2. Extend the array: Add safe protocols such as , , , and to the whitelist. 3. Handle empty tags: When the content is , empty tags do not display text ( ) POC / Fix Code ```php // classes/sanitize.class.php // v6.x-master // Before fix (deleted lines): uri_attrs = array('href','src','longdesc','cite','background','action','formaction','xlink:href','data','srcset'); // After fix (added lines): uri_attrs = array('href','src','longdesc','cite','background','action','formaction','xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:href','data','srcset', 'xlink:

Goal Reached Thanks to every supporter — we hit 100%!

sanitize.class.php htmlClean XSS Vulnerability Analysis and Fix

More from this source