René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Critical][security] mXSS-detection fallback returns unescaped textContent → XSS via all HTML sinks","articleBody":"## Severity: 🔴 Critical (verified exploit)\n\n## Location\n[`src/security/sanitize-core.ts:356-361`](../blob/main/src/security/sanitize-core.ts#L356-L361) — reached through **every** HTML sink: `$el.html()` / `$$.html()` ([`src/core/dom.ts`](../blob/main/src/core/dom.ts), [`src/core/element.ts:236`](../blob/main/src/core/element.ts#L236), [`src/core/collection.ts:229`](../blob/main/src/core/collection.ts#L229)), `.append()/.before()/.after()`, and the **default-sanitized `bq-html` directive** ([`src/view/directives/html.ts:15`](../blob/main/src/view/directives/html.ts#L15)).\n\n## Description\nThe anti-mutation-XSS double-parse ends with a fallback that returns raw, **un-escaped** `textContent`:\n\n```ts\nif (firstPass !== secondPass) {\n  // Content mutated during re-parse - potential mXSS detected.\n  return fragment.textContent ?? '';   // \u003c-- RAW, UNESCAPED\n}\n```\n\nEvery caller assigns the return value of `sanitizeHtmlCore` to `element.innerHTML` / `insertAdjacentHTML`. Everywhere else the function returns *serialized HTML* (safe), but this branch returns *plain text* that is not HTML-escaped. When an attacker supplies the payload HTML-entity-encoded, the parser decodes it into a text node whose data is literally `\u003cimg src=x onerror=alert(1)\u003e`. If the same input also contains a construct that makes serialize→re-parse unstable (trivial via HTML `\u003ctable\u003e` foster-parenting), the \"mXSS detected\" branch fires and hands that raw markup back to the caller, which re-parses it as HTML and executes the payload. **The defense meant to stop mXSS is itself the injection sink.**\n\n## Reproduction (verified against the real `sanitizeHtml` + a real innerHTML sink under happy-dom)\n```ts\nconst payload = '\u003ca\u003e\u003ctable\u003e\u003ca\u003e\u0026lt;img src=x onerror=alert(1)\u0026gt;';\nsanitizeHtmlCore(payload);               // =\u003e \"\u003cimg src=x onerror=alert(1)\u003e\"\nhost.innerHTML = sanitizeHtml(payload);  // =\u003e live \u003cimg src=\"x\" onerror=\"alert(1)\"\u003e fires\n```\nObserved DOM: `\u003cimg src=\"x\" onerror=\"alert(1)\"\u003e` (img count = 1). The `\u003ca\u003e\u003ctable\u003e\u003ca\u003e…` prefix makes the two serialization passes differ (nested-anchor + table foster-parenting), so the fallback returns `fragment.textContent` = the entity-decoded `\u003cimg …\u003e` string. This is standard HTML behavior (identical across DOMParser and `innerHTML` in all standards browsers), not a happy-dom artifact. Reachable in the **default, no-opt-out** configuration.\n\n## Suggested fix\nThe fallback value is destined for an HTML sink, so it must be HTML-escaped (or empty):\n```ts\nif (firstPass !== secondPass) {\n  return escapeHtml(fragment.textContent ?? '');\n}\n```\nMore broadly, reconsider the \"return text on instability\" design in favour of a re-sanitize-to-fixpoint loop (DOMPurify-style), which also avoids silent content destruction. Note the `stripAllTags` path at `sanitize-core.ts:250` returns raw `textContent` too — audit any caller that treats a `stripTags()` result as HTML.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:02:28.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/162/bQuery/issues/162"}