rails-html-sanitizer contains an incomplete fix for an XSS vulnerability

rails-html-sanitizer has a possible XSS vulnerability due to an incomplete fix for CVE-2022-32209 [1][4]. The flaw occurs when the sanitizer's allowed tags are overridden to include both select and style elements. This configuration permits an attacker to inject malicious content.

Exploitation requires the application developer to explicitly override the allowed tags using either the Rails configuration config.action_view.sanitized_allowed_tags or the class method Rails::Html::SafeListSanitizer.allowed_tags= to include both select and style. The vulnerability is not present when allowed tags are overridden via the :tags option in the Action View helper method sanitize or the instance method SafeListSanitizer#sanitize [4].

An attacker can exploit this to perform cross-site scripting (XSS) attacks by injecting arbitrary HTML/JavaScript that would normally be sanitized. The impact is limited to applications that have customized the allowed tags in the specified ways.

The issue is fully patched in version 1.4.4 of rails-html-sanitizer. Users who cannot upgrade should immediately remove either select or style from the overridden allowed tags to mitigate the risk [1][4].