Re: [xml] Incorrect server side include parsing can lead to XSS and other similar issues

2018-01-29 Thread Patrick Toomey
Does anyone have any thoughts on this? Apologies if the original post didn’t concisely outline the issue. In short, the current libxml2 behavior seems to result in well formed HTML being parsed in a way that is round-tripped incorrectly and results in new elements being added. {{{ -> libxml2 git:

Re: [xml] Incorrect server side include parsing can lead to XSS and other similar issues

2018-01-12 Thread Patrick Toomey
Shoot..I see that the href from the example was stripped once it is displayed on https://mail.gnome.org/archives/xml/2018-January/msg00010.html. Here is a gist that preserves formatting: https://gist.github.com/ptoomey3/4f684c7386229658b39b69756e262050. On Fri, Jan 12, 2018 at 10:01 AM Patrick T

[xml] Incorrect server side include parsing can lead to XSS and other similar issues

2018-01-12 Thread Patrick Toomey
While triaging a reported cross site scripting bug we were analyzing the behavior of our HTML sanitization code and noticed that it was parsing an input in an unexpected way. The sanitization library itself eventually wraps Nokogiri, which is a relatively thin wrapper around libxml2. We reached ou