Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply.

Details

While consuming the remnants of a bad URL (CSS Syntax Level 3, §4.3.15), Crass checked whether the previously consumed code point and the next code point formed a valid escape, in addition to checking the next two unconsumed code points. After an escaped backslash, the previously consumed code point is a backslash, so a following ) was incorrectly treated as escaped and the bad URL token continued until the next unescaped ) or the end of the input.

Browsers terminate the bad URL at that ), so everything Crass treated as part of the bad URL is live CSS to a browser.

This bug has existed in every released version of Crass.

Impact

Crass by itself only mis-tokenizes input. The security impact is on CSS sanitizers that use Crass to make allow/deny decisions and then re-serialize the CSS. Exploitation requires a sanitizer that doesn't reject bad URL tokens wherever they occur. Confirmed examples (verified in Chromium against the sanitizers' output):

• Sanitize (all versions through 7.0.0):
  • In Sanitize::CSS.properties and style attributes, a bad URL inside a [...] or (...) block in the value of an allowlisted property can smuggle arbitrary declarations, such as position: fixed or a background-image URL with a disallowed protocol.
  • In Sanitize::CSS.stylesheet and <style> elements, a bad URL in a selector can smuggle arbitrary style rules and at-rules, including @import.
• Loofah (Loofah::HTML5::Scrub.scrub_css, used for style attributes), and therefore rails-html-sanitizer (sanitize_css, and sanitize when style is a permitted attribute): a bad URL inside an allowlisted function such as calc() or rgb() can smuggle declarations Loofah normally strips, such as position: fixed and values.