|
| 1 | +From e1fcd82abba34df74614020343be8eb1fe85f0d9 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Roland Shoemaker <roland@golang.org> |
| 3 | +Date: Mon, 24 Feb 2025 11:18:31 -0800 |
| 4 | +Subject: [PATCH] html: properly handle trailing solidus in unquoted attribute |
| 5 | + value in foreign content |
| 6 | + |
| 7 | +The parser properly treats tags like <p a=/> as <p a="/">, but the |
| 8 | +tokenizer emits the SelfClosingTagToken token incorrectly. When the |
| 9 | +parser is used to parse foreign content, this results in an incorrect |
| 10 | +DOM. |
| 11 | + |
| 12 | +Thanks to Sean Ng (https://ensy.zip) for reporting this issue. |
| 13 | + |
| 14 | +Fixes golang/go#73070 |
| 15 | +Fixes CVE-2025-22872 |
| 16 | + |
| 17 | +Change-Id: I65c18df6d6244bf943b61e6c7a87895929e78f4f |
| 18 | +Reviewed-on: https://go-review.googlesource.com/c/net/+/661256 |
| 19 | +Reviewed-by: Neal Patel <nealpatel@google.com> |
| 20 | +Reviewed-by: Roland Shoemaker <roland@golang.org> |
| 21 | +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> |
| 22 | +Auto-Submit: Gopher Robot <gobot@golang.org> |
| 23 | +Link: https://github.com/golang/net/commit/e1fcd82abba34df74614020343be8eb1fe85f0d9 |
| 24 | +--- |
| 25 | + vendor/golang.org/x/net/html/token.go | 18 ++++++++++++++++-- |
| 26 | + vendor/golang.org/x/net/html/token_test.go | 18 ++++++++++++++++++ |
| 27 | + 2 files changed, 34 insertions(+), 2 deletions(-) |
| 28 | + |
| 29 | +diff --git a/vendor/golang.org/x/net/html/token.go b/vendor/golang.org/x/net/html/token.go |
| 30 | +index 3c57880d69..6598c1f7b3 100644 |
| 31 | +--- a/vendor/golang.org/x/net/html/token.go |
| 32 | ++++ b/vendor/golang.org/x/net/html/token.go |
| 33 | +@@ -839,8 +839,22 @@ func (z *Tokenizer) readStartTag() TokenType { |
| 34 | + if raw { |
| 35 | + z.rawTag = strings.ToLower(string(z.buf[z.data.start:z.data.end])) |
| 36 | + } |
| 37 | +- // Look for a self-closing token like "<br/>". |
| 38 | +- if z.err == nil && z.buf[z.raw.end-2] == '/' { |
| 39 | ++ // Look for a self-closing token (e.g. <br/>). |
| 40 | ++ // |
| 41 | ++ // Originally, we did this by just checking that the last character of the |
| 42 | ++ // tag (ignoring the closing bracket) was a solidus (/) character, but this |
| 43 | ++ // is not always accurate. |
| 44 | ++ // |
| 45 | ++ // We need to be careful that we don't misinterpret a non-self-closing tag |
| 46 | ++ // as self-closing, as can happen if the tag contains unquoted attribute |
| 47 | ++ // values (i.e. <p a=/>). |
| 48 | ++ // |
| 49 | ++ // To avoid this, we check that the last non-bracket character of the tag |
| 50 | ++ // (z.raw.end-2) isn't the same character as the last non-quote character of |
| 51 | ++ // the last attribute of the tag (z.pendingAttr[1].end-1), if the tag has |
| 52 | ++ // attributes. |
| 53 | ++ nAttrs := len(z.attr) |
| 54 | ++ if z.err == nil && z.buf[z.raw.end-2] == '/' && (nAttrs == 0 || z.raw.end-2 != z.attr[nAttrs-1][1].end-1) { |
| 55 | + return SelfClosingTagToken |
| 56 | + } |
| 57 | + return StartTagToken |
0 commit comments