+ "details": "### Summary\n\nBleach `clean()` / `Cleaner()` fails to sanitize dangerous URI schemes in allowed `formaction` attributes.\n\nBleach applies URI protocol sanitization only to attributes listed in `attr_val_is_uri`. While URI-bearing attributes such as `action`, `href`, `src`, and `poster` are included in that set, `formaction` is not. As a result, if a downstream application explicitly allows `formaction` on submit-capable controls in untrusted HTML, Bleach preserves dangerous values such as `javascript:alert(1)` instead of stripping them.\n\nThis can lead to **submit-triggered JavaScript execution** in applications that rely on Bleach to sanitize untrusted HTML and allow the relevant tag/attribute combination.\n\n---\n\n### Details\n\nThe issue appears to be a URI-sanitization coverage gap in Bleach’s sanitizer logic.\n\nRelevant code paths:\n\n* `bleach/sanitizer.py` — `BleachSanitizerFilter.allow_token` (around line 553)\n* `bleach/_vendor/html5lib/filters/sanitizer.py` — `attr_val_is_uri` (around line 525)\n\nIn `BleachSanitizerFilter.allow_token`, URI protocol sanitization is only applied when:\n\n```python id=\"pft79m\"\nif namespaced_name in self.attr_val_is_uri:\n```\n\nHowever, `(None, 'formaction')` is currently missing from `attr_val_is_uri`.\n\nThis creates an inconsistency where `action` is protocol-sanitized, but `formaction` is not.\n\nAs a result, if a downstream application allows:\n\n* tags such as `<button>` or `<input>`\n* the `formaction` attribute\n\nthen Bleach preserves dangerous URI schemes such as `javascript:` in `formaction`.\n\nExamples of affected submit-capable controls include:\n\n* `<button>` (default submit behavior unless `type=\"button\"` is set)\n* `<input type=\"submit\">`\n* `<input type=\"image\">`\n\nThis appears to be a real library-side sanitizer gap rather than only an application misuse issue, because Bleach already treats similar URI-bearing attributes (such as `action`) as protocol-sensitive and sanitizes them.\n\nSuggested minimal fix:\n\nAdd:\n\n```python id=\"4v4fkn\"\n(None, 'formaction')\n```\n\nto `attr_val_is_uri` in:\n\n* `bleach/_vendor/html5lib/filters/sanitizer.py`\n\nI also prepared a minimal patch and focused regression tests if helpful.\n\n---\n\n### PoC\n\nBelow are minimal reproductions using `bleach.clean()`.\n\n#### 1) `<button>`\n\n```python id=\"d3g0v7\"\nfrom bleach import clean\n\nprint(clean(\n '<form><button formaction=\"javascript:alert(1)\">go</button></form>',\n tags={'form', 'button'},\n attributes={'button': ['formaction']},\n))\n```\n\n**Actual output:**\n\n```html id=\"i4nd7s\"\n<form><button formaction=\"javascript:alert(1)\">go</button></form>\n```\n\n**Expected output:**\n\n```html id=\"g4d2r1\"\n<form><button>go</button></form>\n```\n\n---\n\n#### 2) `<input type=\"submit\">`\n\n```python id=\"l4dy0j\"\nprint(clean(\n '<form><input type=\"submit\" formaction=\"javascript:alert(1)\" value=\"go\"></form>',\n tags={'form', 'input'},\n attributes={'input': ['type', 'formaction', 'value']},\n))\n```\n\n**Actual output:**\n\n```html id=\"h8lgbt\"\n<form><input type=\"submit\" formaction=\"javascript:alert(1)\" value=\"go\"></form>\n```\n\n**Expected output:**\n\n```html id=\"6y8mws\"\n<form><input type=\"submit\" value=\"go\"></form>\n```\n\n---\n\n#### 3) `<input type=\"image\">`\n\n```python id=\"g8q0x8\"\nprint(clean(\n '<form><input type=\"image\" formaction=\"javascript:alert(1)\" src=\"/foo.png\"></form>',\n tags={'form', 'input'},\n attributes={'input': ['type', 'formaction', 'src']},\n))\n```\n\n**Actual output:**\n\n```html id=\"fd22kg\"\n<form><input type=\"image\" formaction=\"javascript:alert(1)\" src=\"/foo.png\"></form>\n```\n\n**Expected output:**\n\n```html id=\"z6t6je\"\n<form><input type=\"image\" src=\"/foo.png\"></form>\n```\n\n---\n\n### Impact\n\nThis is a **client-side HTML sanitization bypass / dangerous URI preservation issue**.\n\nIf an application relies on Bleach to sanitize untrusted HTML and explicitly allows:\n\n* `formaction`\n* and submit-capable controls such as `<button>` or `<input>`\n\nthen Bleach can emit sanitized output that still contains a dangerous `javascript:` URI in `formaction`.\n\nThat can lead to **submit-triggered JavaScript execution** when the user activates the control.\n\nImpact is limited to configurations that explicitly allow the relevant tag/attribute combination, but the issue is still security-relevant because:\n\n* `formaction` is a real browser sink\n* Bleach already protocol-sanitizes similar URI-bearing attributes like `action`\n* the omission creates inconsistent sanitizer coverage for dangerous URI schemes\n\nI would currently assess this as **Medium severity**.\n\nIf useful, I also have:\n\n* a minimal patch\n* focused regression tests for:\n\n * `<button formaction=\"javascript:...\">`\n * `<input type=\"submit\" formaction=\"javascript:...\">`\n * `<input type=\"image\" formaction=\"javascript:...\">`\n * a safe control case where `formaction=\"/submit\"` is preserved",
![advisory-database[bot]](https://avatars.githubusercontent.com/in/21409?v=4&size=40){kind=avatar}
0 commit comments