https://bz.apache.org/bugzilla/show_bug.cgi?id=70191
Bug ID: 70191
Summary: Possible impact of htmlAttrAllowed() deprecation on
mod_proxy_html
Product: Apache httpd-2
Version: 2.4.68
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_proxy_html
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Hello,
While evaluating Apache 2.4.68 mod_proxy_html in combination with libxml2
2.15.3, I noticed that htmlAttrAllowed() in libxml2 has been marked as
deprecated.
I am concerned that this change may affect the HTML attribute validation
behavior of mod_proxy_html.
For example, in an environment configured as follows:
ProxyHTMLEnable On
ProxyHTMLDocType HTML
ProxyHTMLLinks img src
ProxyHTMLLinks div id
suppose the backend returns the following HTML:
<html><body><img src="/missing.png" onerror="alert(1)" data-evil="x"><div
onclick="alert(2)">text</div></body></html>
As I understand it, htmlAttrAllowed() was used to determine whether a
particular attribute is allowed for a given element based on the HTML DTD.
If this functionality is no longer effectively available, attributes that were
previously treated as invalid, inappropriate, or deprecated could potentially
pass through unchanged.
In the example above, attributes such as onerror and data-evil remained in the
output.
I understand that mod_proxy_html is not intended to be a security filter.
However, in configurations where HTML generated by an untrusted backend is
processed, it seems possible that security implications could arise if the
expected attribute validation is no longer performed.
I would appreciate your review of this concern.
Additional information:
In libxml2 2.13.9, htmlAttrAllowed() was not deprecated and appeared to
function as expected.
In libxml2 2.15.3, htmlAttrAllowed() is marked as deprecated, and its
implementation consists only of:
return(HTML_VALID);
Thank you.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
