Improper neutralization of data URIs allows XSS in rails-html-sanitizer

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >=1.0.3, <1.4.4 are vulnerable to cross-site scripting (XSS) via data URIs when used in combination with Loofah >=2.1.0 [1][4]. The root cause is a divergence in the PermitScrubber class, which does not properly validate data URIs, unlike Loofah's scrubber that includes a safe data URI check [4].

An attacker can exploit this by crafting an HTML fragment containing an ` with a src attribute set to a data URI, such as data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=` [4]. The sanitizer fails to remove or escape the data URI, allowing the base64-encoded JavaScript to execute in the victim's browser. This attack does not require authentication and can be triggered by submitting unsanitized user input [4].

Successful exploitation leads to arbitrary JavaScript execution in the context of the user's session, potentially allowing theft of cookies, session tokens, or other sensitive information, or performing actions on behalf of the victim [1].

The issue is patched in rails-html-sanitizer version 1.4.4 [1]. Users are advised to upgrade immediately. No workaround is available for older versions.