rust-ammonia/ammonia · Security
Space bug in `clean_text`
- GHSA ID
- GHSA-p2g9-94wh-65c2
- Severity
- medium
- Published
- Updated
Description
An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
let html = format!("<div title={}>", clean_text(user_supplied_string));
Applications are not affected if they quote their attributes, or if they don't use clean_text at all.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')