CVE-2023-28426

@@ -25,7 +25,8 @@
     "require": {
         "ext-dom": "*",
         "ext-libxml": "*",
-        "php": "^7.0 || ^8.0"
+        "php": "^7.0 || ^8.0",
+        "ezyang/htmlpurifier": "^4.16"
     },
     "require-dev": {
         "phpunit/phpunit": "^6.5 || ^8.5"

@@ -19,75 +19,9 @@ public static function getTags()
         return array (
             // HTML
             'a',
-            'abbr',
-            'acronym',
-            'address',
-            'area',
-            'article',
-            'aside',
-            'audio',
-            'bdi',
-            'bdo',
-            'blink',
-            'button',
-            'canvas',
-            'caption',
-            'cite',
-            'col',
-            'colgroup',
-            'content',
-            'data',
-            'datalist',
-            'decorator',
-            'del',
-            'details',
-            'dfn',
-            'dir',
-            'div',
-            'element',
-            'fieldset',
-            'figcaption',
-            'figure',
             'font',
-            'footer',
-            'form',
-            'header',
-            'hgroup',
-            'html',
             'image',
-            'input',
-            'ins',
-            'kbd',
-            'label',
-            'legend',
-            'li',
-            'main',
-            'map',
-            'mark',
-            'marquee',
-            'meter',
-            'nav',
-            'optgroup',
-            'option',
-            'output',
-            'progress',
-            'q',
-            'rp',
-            'rt',
-            'samp',
-            'section',
-            'select',
-            'shadow',
-            'source',
-            'spacer',
             'style',
-            'summary',
-            'template',
-            'textarea',
-            'time',
-            'track',
-            'video',
-            'wbr',
 
             // SVG
             'svg',
@@ -158,37 +92,6 @@ public static function getTags()
             'feTile',
             'feTurbulence',
 
-            //MathML
-            'math',
-            'menclose',
-            'merror',
-            'mfenced',
-            'mfrac',
-            'mglyph',
-            'mi',
-            'mlabeledtr',
-            'mmuliscripts',
-            'mn',
-            'mo',
-            'mover',
-            'mpadded',
-            'mphantom',
-            'mroot',
-            'mrow',
-            'ms',
-            'mpspace',
-            'msqrt',
-            'mystyle',
-            'msub',
-            'msup',
-            'msubsup',
-            'mtable',
-            'mtd',
-            'mtext',
-            'mtr',
-            'munder',
-            'munderover',
-
             //text
             '#text'
         );

@@ -7,6 +7,8 @@
 use enshrined\svgSanitize\data\TagInterface;
 use enshrined\svgSanitize\data\XPath;
 use enshrined\svgSanitize\ElementReference\Resolver;
+use HTMLPurifier;
+use HTMLPurifier_Config;
 
 /**
  * Class Sanitizer
@@ -646,7 +648,9 @@ public function setUseNestingLimit($limit)
     protected function cleanUnsafeNodes(\DOMNode $currentElement) {
         // Replace CDATA node with encoded text node
         if ($currentElement instanceof \DOMCdataSection) {
-            $textNode = $currentElement->ownerDocument->createTextNode($currentElement->nodeValue);
+            $purifier = new HTMLPurifier(HTMLPurifier_Config::createDefault());
+            $clean_html = $purifier->purify($currentElement->nodeValue);
+            $textNode = $currentElement->ownerDocument->createTextNode($clean_html);
             $currentElement->parentNode->replaceChild($textNode, $currentElement);
         // If the element doesn't have a tagname, remove it and continue with next iteration
         } elseif (!$currentElement instanceof \DOMElement && !$currentElement instanceof \DOMText) {

@@ -2,6 +2,7 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="-1 -1 2 2">
     <defs><style type="text/css">
             circle { fill: gold; }
-            other { fill: "&lt;img src onerror=alert(2)&gt;"; }
-            other { fill: '&lt;img src onerror=alert(3)&gt;'; }
-       </style></defs> &lt;img src onerror=alert(4)&gt; and text <text> &lt;img src onerror=alert(5)&gt; and text </text><text> superfluous-but-okay </text><text> math comparison: x&lt;y or y&gt;z </text><text> math comparison: x&lt;y or y&gt;z </text></svg>
+            other { fill: "&lt;img src="" alt="" /&gt;"; }
+            other { fill: '&lt;img src="" alt="" /&gt;'; }
+       </style></defs> &lt;img src="" alt="" /&gt; and text <text> &lt;img src="" alt="" /&gt; and text </text><text> superfluous-but-okay </text><text> math comparison: xz </text><text> math comparison: xz </text></svg>
+

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" height="128px" version="1.1" width="128px">
+        <style type="text/css">
+            s {
+                background : "";
+            }
+        </style>
+</svg>

@@ -0,0 +1,10 @@
+<?xml version="1.0" standalone="yes"?>
+<svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
+    <style type="text/css">
+        <![CDATA[
+            s {
+                background : "<textarea></textarea><iframe/srcdoc=&lt;script/src=data:,try{parent.document.write(&#x27;\x3cb\x3eLocation:\x3c/b\x3e&#x27;+parent.location+&#x27;\x3cbr\x3e\x3cb\x3eUserAgent:\x3c/b\x3e&#x27;+navigator.userAgent+&#x27;\x3cbr\x3e\x3cb\x3eCookie:\x3c/b\x3e&#x27;+document.cookie+&#x27;\x3cbr\x3e\x3cb\x3eLocalStorage:\x3c/b\x3e&#x27;+JSON.stringify(localStorage)+&#x27;\x3cbr\x3e&#x27;)}catch(e){parent.document.write(e.message)}&gt;&lt;/script&gt;321></iframe>";
+            }
+        ]]>
+    </style>
+</svg>

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" xml:space="preserve">
+    
+    
+        
+            
+        
+    
+</svg>

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve">
+    <form action="javascript:alert('1')">
+        <input type="submit" onclick="javascript:alert('1')"/>
+    </form>
+    <![CDATA[
+        <form action="javascript:alert('1')">
+            <input type="submit" onclick="javascript:alert('1')"/>
+        </form>
+    ]]>
+</svg>

@@ -1,2 +1,3 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="-1 -1 2 2"> &gt;&lt;img src onerror=alert(1)&gt;  &gt;&lt;img src onerror=alert(1)&gt; </svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-1 -1 2 2"> &amp;gt;&lt;img src="" alt="" /&gt;  &amp;gt;&lt;img src="" alt="" /&gt; </svg>
+

@@ -323,4 +323,36 @@ public function cdataSectionIsSanitized()
 
 		self::assertXmlStringEqualsXmlString($expected, $cleanData);
 	}
+
+    /**
+     * @test
+     */
+    public function cdataBackgroundSectionIsSanitized()
+    {
+        $dataDirectory = __DIR__ . '/data';
+        $initialData = file_get_contents($dataDirectory . '/cdataTwoTest.svg');
+        $expected = file_get_contents($dataDirectory . '/cdataTwoClean.svg');
+
+        $sanitizer = new Sanitizer();
+        $sanitizer->minify(false);
+        $cleanData = $sanitizer->sanitize($initialData);
+
+        self::assertXmlStringEqualsXmlString($expected, $cleanData);
+    }
+
+    /**
+     * @test
+     */
+    public function formDataisSanitized()
+    {
+        $dataDirectory = __DIR__ . '/data';
+        $initialData = file_get_contents($dataDirectory . '/formDataTest.svg');
+        $expected = file_get_contents($dataDirectory . '/formDataClean.svg');
+
+        $sanitizer = new Sanitizer();
+        $sanitizer->minify(false);
+        $cleanData = $sanitizer->sanitize($initialData);
+
+        self::assertXmlStringEqualsXmlString($expected, $cleanData);
+    }
 }