[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ crass (indirect, 1.0.7 → 1.0.8) · Repo · Changelog

Security Advisories 🚨

🚨 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply.

Details

While consuming the remnants of a bad URL (CSS Syntax Level 3, §4.3.15), Crass checked whether the previously consumed code point and the next code point formed a valid escape, in addition to checking the next two unconsumed code points. After an escaped backslash, the previously consumed code point is a backslash, so a following ) was incorrectly treated as escaped and the bad URL token continued until the next unescaped ) or the end of the input.

Browsers terminate the bad URL at that ), so everything Crass treated as part of the bad URL is live CSS to a browser.

This bug has existed in every released version of Crass.

Impact

Crass by itself only mis-tokenizes input. The security impact is on CSS sanitizers that use Crass to make allow/deny decisions and then re-serialize the CSS. Exploitation requires a sanitizer that doesn't reject bad URL tokens wherever they occur. Confirmed examples (verified in Chromium against the sanitizers' output):

• Sanitize (all versions through 7.0.0):
  • In Sanitize::CSS.properties and style attributes, a bad URL inside a [...] or (...) block in the value of an allowlisted property can smuggle arbitrary declarations, such as position: fixed or a background-image URL with a disallowed protocol.
  • In Sanitize::CSS.stylesheet and <style> elements, a bad URL in a selector can smuggle arbitrary style rules and at-rules, including @import.
• Loofah (Loofah::HTML5::Scrub.scrub_css, used for style attributes), and therefore rails-html-sanitizer (sanitize_css, and sanitize when style is a permitted attribute): a bad URL inside an allowlisted function such as calc() or rgb() can smuggle declarations Loofah normally strips, such as position: fixed and url() values.

Smuggled CSS can be used for UI redress (clickjacking or phishing overlays), loading attacker-controlled external resources, and, where rules or @import can be smuggled, CSS-based data exfiltration. This vulnerability doesn't allow script execution in modern browsers.

Patches

Fixed in Crass 1.0.8. Users of Sanitize, Loofah, rails-html-sanitizer, or any other library that uses Crass to sanitize CSS should upgrade Crass to 1.0.8 or later.

Workarounds

There are no practical workarounds other than upgrading. Rejecting any CSS input that contains the character sequence \\ would block the known trigger, but this is a blunt measure and may reject legitimate CSS.

References

• CSS Syntax Module Level 3, "Consume the remnants of a bad url": https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url

Release Notes

1.0.8

Security

• Moderate: Fixed a tokenizer bug in which a ) following an escaped backslash (\\) inside a bad URL didn't terminate the bad URL token, causing Crass to consume more input than a spec-compliant browser would. CSS sanitizers built on Crass could be tricked into passing through declarations, rules, or at-rules that a browser would then apply. (GHSA-pq4g-8rxf-4g29)

Full Changelog: v1.0.7...v1.0.8

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

• Release 1.0.8
• Fix bad URL token not terminating at ) after an escaped backslash
• Add SECURITY.md

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)