Debian Rust Security Tracker 🩺🦀

RUSTSEC-2021-0157: Incorrect escaping for `url("")` functions in CSS style attributes

0 affected
Crate
ammonia
Patched Versions
>=4.2.3
>=4.1.7, <4.2.0
Debian Version
4.2.3-1
Debian Bugs
—
Issued
2021-10-10
Aliases
GHSA-69v2-w9vg-4g83
Patched:Affected

In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.

As an example, this snippet:

<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>

Would erroneously "sanitize" to:

<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>

This vulnerability was reported by Uttej Badwane