Cross-site scripting in Bleach

Impact

A mutation XSS affects users calling bleach.clean with all of:

• svg or math in the allowed tags
• p or br in allowed tags
• style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags
• the keyword argument strip_comments=False

Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

Workarounds

• modify bleach.clean calls to at least one of:

  • not allow the style, title, noscript, script, textarea, noframes, iframe, or xmp tag
  • not allow svg or math tags
  • not allow p or br tags
  • set strip_comments=True

• A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1689399
• https://advisory.checkmarx.net/advisory/CX-2021-4303
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980