Fix hex escape issue in style element

mganss · mganss · commit a3a7602a44d4 · 2020-12-23T12:42:48.000+01:00
diff --git a/src/HtmlSanitizer/HtmlSanitizer.cs b/src/HtmlSanitizer/HtmlSanitizer.cs
@@ -743,7 +743,7 @@ private void SanitizeStyleSheets(IHtmlDocument dom, string baseUrl)
                     else i++;
                 }
 
-                styleTag.InnerHtml = styleSheet.ToCss();
+                styleTag.InnerHtml = styleSheet.ToCss().Replace("<", "\\3c");
             }
         }
 
diff --git a/test/HtmlSanitizer.Tests/Tests.cs b/test/HtmlSanitizer.Tests/Tests.cs
@@ -3201,6 +3201,19 @@ public void PreParsedDocumentWithContextTest()
 
             Assert.Equal("<html><head></head><body><div>hi</div></body></html>", returnedDocument.ToHtml());
         }
+
+        [Fact]
+        public void StyleByPassTest()
+        {
+            var sanitizer = new HtmlSanitizer();
+
+            sanitizer.AllowedTags.Add("style");
+
+            var html = "aaabc<style>x[x='\\3c /style>\\3c img src onerror=alert(1)>']{}</style>";
+            var sanitized = sanitizer.Sanitize(html, "http://www.example.com");
+
+            Assert.Equal("aaabc<style>x[x=\"\\3c/style>\\3cimg src onerror=alert(1)>\"] { }</style>", sanitized);
+        }
     }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -743,7 +743,7 @@ private void SanitizeStyleSheets(IHtmlDocument dom, string baseUrl)`
`743`	`743`	`else i++;`
`744`	`744`	`}`
`745`	`745`
`746`		`- styleTag.InnerHtml = styleSheet.ToCss();`
	`746`	`+ styleTag.InnerHtml = styleSheet.ToCss().Replace("<", "\\3c");`
`747`	`747`	`}`
`748`	`748`	`}`
`749`	`749`
Original file line number	Diff line number	Diff line change
`@@ -3201,6 +3201,19 @@ public void PreParsedDocumentWithContextTest()`
`3201`	`3201`
`3202`	`3202`	`Assert.Equal("<html><head></head><body><div>hi</div></body></html>", returnedDocument.ToHtml());`
`3203`	`3203`	`}`
	`3204`	`+`
	`3205`	`+ [Fact]`
	`3206`	`+ public void StyleByPassTest()`
	`3207`	`+ {`
	`3208`	`+ var sanitizer = new HtmlSanitizer();`
	`3209`	`+`
	`3210`	`+ sanitizer.AllowedTags.Add("style");`
	`3211`	`+`
	`3212`	`+ var html = "aaabc<style>x[x='\\3c /style>\\3c img src onerror=alert(1)>']{}</style>";`
	`3213`	`+ var sanitized = sanitizer.Sanitize(html, "http://www.example.com");`
	`3214`	`+`
	`3215`	`+ Assert.Equal("aaabc<style>x[x=\"\\3c/style>\\3cimg src onerror=alert(1)>\"] { }</style>", sanitized);`
	`3216`	`+ }`
`3204`	`3217`	`}`
`3205`	`3218`	`}`
`3206`	`3219`