Record GHSA-vqwm-jvq2-mfwc and pin its reported cases - #505
Merged
Merged
Conversation
GHSA-vqwm-jvq2-mfwc, published today, reported the first fix for CVE-2025-66021 incomplete: an allowed element's tag inside kept style or script text came through verbatim, so its attribute and URL policies never ran. Release 20260921.1 fixed it (#465, #472). List the advisory in docs/vulnerabilities.md and point the CVE-2025-66021 entry at 20260921.1, since 20260102.1 is still affected. Add the reporter's URL, quoted-value and script cases as regression tests; test #7 already covers the attribute case. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GHSA-vqwm-jvq2-mfwc was published today. It reports that the first fix for CVE-2025-66021 was incomplete: when a policy allows text in
styleorscript, an allowed element's tag inside that text came through verbatim, so its attribute and URL policies never ran. Release 20260921.1 fixed it in #465 and #472. A CVE ID has been requested and is pending.This PR records the advisory and adds regression tests now that the advisory and the fixed release are both out, the order AGENTS.md requires.
Docs
docs/vulnerabilities.md.Tests (
HtmlSanitizerTest)testCVE202566021_17…uses the reporter's policy and payloads for the URL-policy case (src=javascript:), the>-inside-a-quoted-value case, and the attribute case.testCVE202566021_18…covers the reporter'sscriptcase.noscriptpolicy.All of the reporter's payloads come through unchanged on 20240325.1, 20260101.1, 20260102.1 and 20260313.1. None do on 20260921.1 or main.
No production code changes.
Testing:
./mvnw clean verifypasses on JDK 11 and JDK 17 (702 tests).🤖 Generated with Claude Code