Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rgrove/sanitize

              main @ b5f1201
            

Fixes

CVEs

HIGH

Peak severity

64.7%

Coverage

Highlights

Cross-Site Scripting (XSS): 9 prior fixes. Scrutinize any change in this area.

lib/sanitize/transformers/clean_element.rb: most-fixed (8 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): The parser differential between Nokogiri and web browsers on elements like '<noscript>' or child elements in iframes can be exploited to bypass HTML sanitization rules entirely. Developers must completely remove certain tag contents regardless of custom configuration parameters.

Cross-Site Scripting (XSS): CSS functions and values, specifically regarding image references, are highly prone to protocol allowlist bypasses. Sanitization must explicitly enforce protocol checks on both standard and vendor-prefixed CSS function patterns to prevent executable JavaScript schemes.

Cross-Site Scripting: Inadequate defaults for foreign content (SVG and MathML) allow attackers to embed scriptable nested context that bypasses simple element stripping. A robust default configuration must discard the inner contents of removed elements and carefully restrict these foreign namespaces.