|
| 1 | +From 4a1dbe133fb5d26ab4619d082c598527e47887c4 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Sreenivasulu Malavathula <v-smalavathu@microsoft.com> |
| 3 | +Date: Tue, 22 Apr 2025 19:25:27 -0500 |
| 4 | +Subject: [PATCH] Address CVE-2025-22872 |
| 5 | +Upstream Patch Reference: https://github.com/golang/net/commit/e1fcd82abba34df74614020343be8eb1fe85f0d9 |
| 6 | + |
| 7 | +--- |
| 8 | + vendor/golang.org/x/net/html/token.go | 18 ++++++++++++++++-- |
| 9 | + 1 file changed, 16 insertions(+), 2 deletions(-) |
| 10 | + |
| 11 | +diff --git a/vendor/golang.org/x/net/html/token.go b/vendor/golang.org/x/net/html/token.go |
| 12 | +index 5c2a1f4..7549c62 100644 |
| 13 | +--- a/vendor/golang.org/x/net/html/token.go |
| 14 | ++++ b/vendor/golang.org/x/net/html/token.go |
| 15 | +@@ -839,8 +839,22 @@ func (z *Tokenizer) readStartTag() TokenType { |
| 16 | + if raw { |
| 17 | + z.rawTag = strings.ToLower(string(z.buf[z.data.start:z.data.end])) |
| 18 | + } |
| 19 | +- // Look for a self-closing token like "<br/>". |
| 20 | +- if z.err == nil && z.buf[z.raw.end-2] == '/' { |
| 21 | ++ // Look for a self-closing token (e.g. <br/>). |
| 22 | ++ // |
| 23 | ++ // Originally, we did this by just checking that the last character of the |
| 24 | ++ // tag (ignoring the closing bracket) was a solidus (/) character, but this |
| 25 | ++ // is not always accurate. |
| 26 | ++ // |
| 27 | ++ // We need to be careful that we don't misinterpret a non-self-closing tag |
| 28 | ++ // as self-closing, as can happen if the tag contains unquoted attribute |
| 29 | ++ // values (i.e. <p a=/>). |
| 30 | ++ // |
| 31 | ++ // To avoid this, we check that the last non-bracket character of the tag |
| 32 | ++ // (z.raw.end-2) isn't the same character as the last non-quote character of |
| 33 | ++ // the last attribute of the tag (z.pendingAttr[1].end-1), if the tag has |
| 34 | ++ // attributes. |
| 35 | ++ nAttrs := len(z.attr) |
| 36 | ++ if z.err == nil && z.buf[z.raw.end-2] == '/' && (nAttrs == 0 || z.raw.end-2 != z.attr[nAttrs-1][1].end-1) { |
| 37 | + return SelfClosingTagToken |
| 38 | + } |
| 39 | + return StartTagToken |
| 40 | +-- |
| 41 | +2.45.2 |
| 42 | + |
0 commit comments