Bug 768336

Summary:	<dev-python/bleach-3.3.0: mutation XSS via allowed math or svg, p, and style tags with strip_comments=False
Product:	Gentoo Security	Reporter:	Michał Górny <mgorny>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	python
Priority:	Normal	Flags:	nattka: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq
Whiteboard:	B4 [noglsa]
Package list:	dev-python/bleach-3.3.0	Runtime testing required:	---

Description Michał Górny archtester

2021-02-02 08:38:11 UTC

A mutation XSS affects users calling bleach.clean with all of:

- svg or math in the allowed tags
- p or br in allowed tags
- style in allowed tags
- the keyword argument strip_comments=False

Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

Comment 1 Sam James archtester

2021-02-02 21:00:47 UTC

amd64 arm arm64 hppa ppc ppc64 s390 sparc x86 (ALLARCHES) done

all arches done

Comment 2 Sam James archtester

2021-02-02 21:08:54 UTC

Please cleanup, thanks!

Comment 3 Larry the Git Cow gentoo-dev

2021-02-02 21:22:34 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f3437318a81f6163f7a65c9d79c3c7d0f6a2e5e1

commit f3437318a81f6163f7a65c9d79c3c7d0f6a2e5e1
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2021-02-02 21:06:31 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2021-02-02 21:22:30 +0000

    dev-python/bleach: Remove old
    
    Bug: https://bugs.gentoo.org/768336
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 dev-python/bleach/Manifest            |  3 ---
 dev-python/bleach/bleach-3.2.1.ebuild | 39 -----------------------------------
 dev-python/bleach/bleach-3.2.2.ebuild | 39 -----------------------------------
 dev-python/bleach/bleach-3.2.3.ebuild | 39 -----------------------------------
 4 files changed, 120 deletions(-)

Comment 4 Sam James archtester

2021-02-02 21:30:20 UTC

All done, thanks!