Multiple XSS Filter Bypassesvalidator
validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the denylist-based filter.
Proof of Concept
Various inputs that could bypass the filter were discovered:
Improper parsing of nested tags:
<s <onmouseover="alert(1)"> <;s onmouseover="alert(1)">This is a test</s>
<div style="z-index: 9999999; background-color: green; width: 100%; height: 100%"> <h1>You have won</h1>Please click the link and enter your login details: <a href="http://example.com/">http://good.com</a> </div>
Bypass via Nested Forbidden Strings:
Additional bypasses were discovered by Krzysztof Kotowicz in 2012 when auditing CodeIgniter's XSS filtering function, which this code was based off of.
If you are a developer currently using the xss filter function from the validator package, you should consider replacing it with the escape filter function from the same package. This function replaces all instances of angle brackets (<, >), ampersands, and quotation marks, so no HTML tags will be processed.
publishedAdvisory publishedJul 5th, 2013
reportedInitial report by Neal Poole, Krzysztof KotowiczOct 17th, 2015