Contrib.social

Remove srcdoc attributes in Xss::filter()

Open on Drupal.org →
Created on 7 March 2025, about 2 months ago

Problem/Motivation

The Xss::filter() method does not remove srcdoc attributes from iframe tags.
This attribute can be used to inject JS into the page.
The XSS filter removes other dangerous attributes like onclick or onload, so I think it should also remove srcdoc.

Xss::filter() does not allow iframe tags by default, so it needs to be called explicitly with iframe in the $allowed_html_tags parameter to be vulnerable.
You could argue that this is a misuse of the XSS filter, but I think it is an easy mistake to make and it could benefit from this hardening.

This was originally logged as a private issue to the security team, but was cleared to be moved to the public queue.

Steps to reproduce

If someone calls this:

\Drupal\Component\Utility\Xss::filter('<iframe srcdoc="&lt;script&gt;alert(document.cookie)&lt;/script&gt;"></iframe>', ['iframe'])

They could expect a safe iframe tag to be returned but instead the returned HTML could containe malicious JS.

Proposed resolution

Remove srcdoc attributes in Xss::attributes().

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Active

Version

11.0 🔥

Component

other

Created by

🇫🇷France prudloff Lille

Live updates comments and jobs are added and updated live.
  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024