HTMLSanitizer should strip style attributes by default

[jim-genshi.edgewall.org@…]

The current filter special-cases the style attribute and attempts to strip it of dangerous properties. However the current code is easy to bypass, and implementing a proper filter is non-trivial. The style attribute should be removed from SAFE_ATTRS.

[cmlenz]

Can you provide examples how the style-filtering is easy to bypass?

[jim-genshi.edgewall.org@…]

Replying to cmlenz:

Can you provide examples how the style-filtering is easy to bypass?

Firstly, you can avoid straight string matches with backslashes or escaped Unicode characters. Secondly, you can do all kinds of annoying things with other properties, like black out the entire page. Thirdly it does a naïve split along semicolons to separate the declarations — with creative use of string escaping, it might be possible to get more stuff past it that way.

[cmlenz]

Okay, in [523] I removed style from the default set of safe attributes. I also added handling of unicode escapes, so that attacks relying on that technique should be avoided.

If there are any other concrete examples for vulnerabilities of the sanitizer, I'd love to hear about them!