[SECURITY] Mitigate raw-text bypass with ALLOW_INSECURE_RAW_TEXT

ohader · ohader · commit bd1a88d9b5a5 · 2026-06-08T17:13:53.000+02:00
Escape whitespace-variant closing tags (e.g. </style\t>) in serialised raw text content to prevent browser-parser differentials where browsers exit raw text mode early but the sanitizer does not. Deny raw text passthrough inside <noscript>, where browsers with JavaScript enabled parse the content as raw text, making inner closing tags invisible and allowing payloads to escape the raw text context. Security-References: CVE-2026-47344
diff --git a/src/Parser/Html5.php b/src/Parser/Html5.php
@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\HtmlSanitizer\Parser;
+
+use DOMDocument;
+use DOMDocumentFragment;
+use Masterminds\HTML5 as MastermindsHTML5;
+use Masterminds\HTML5\Parser\DOMTreeBuilder;
+use Masterminds\HTML5\Parser\Scanner;
+
+/**
+ * Extends the Masterminds HTML5 parser to substitute the local Tokenizer
+ * subclass, which fixes raw-text end-tag handling for whitespace variants.
+ */
+class Html5 extends MastermindsHTML5
+{
+    #[\Override]
+    public function parse($input, array $options = []): DOMDocument
+    {
+        $this->errors = [];
+        $options = array_merge($this->getOptions(), $options);
+        $events = new DOMTreeBuilder(false, $options);
+        $scanner = new Scanner($input, !empty($options['encoding']) ? $options['encoding'] : 'UTF-8');
+        $parser = new Tokenizer(
+            $scanner,
+            $events,
+            !empty($options['xmlNamespaces']) ? Tokenizer::CONFORMANT_XML : Tokenizer::CONFORMANT_HTML
+        );
+
+        $parser->parse();
+        $this->errors = $events->getErrors();
+
+        return $events->document();
+    }
+
+    #[\Override]
+    public function parseFragment($input, array $options = []): DOMDocumentFragment
+    {
+        $options = array_merge($this->getOptions(), $options);
+        $events = new DOMTreeBuilder(true, $options);
+        $scanner = new Scanner($input, !empty($options['encoding']) ? $options['encoding'] : 'UTF-8');
+        $parser = new Tokenizer(
+            $scanner,
+            $events,
+            !empty($options['xmlNamespaces']) ? Tokenizer::CONFORMANT_XML : Tokenizer::CONFORMANT_HTML
+        );
+
+        $parser->parse();
+        $this->errors = $events->getErrors();
+
+        return $events->fragment();
+    }
+}
diff --git a/src/Parser/Tokenizer.php b/src/Parser/Tokenizer.php
@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\HtmlSanitizer\Parser;
+
+use Masterminds\HTML5\Elements;
+use Masterminds\HTML5\Parser\Tokenizer as MastermindsTokenizer;
+
+/**
+ * Extends the Masterminds tokenizer to fix rawText() so that it recognises
+ * whitespace-variant closing tags (e.g. </style\t>) as valid end tags per
+ * HTML5 spec § 8.2.6.1, aligning it with the existing rcdata() behaviour.
+ */
+class Tokenizer extends MastermindsTokenizer
+{
+    #[\Override]
+    protected function rawText($tok): bool
+    {
+        if ($this->untilTag === null) {
+            return $this->text($tok);
+        }
+
+        // Search for `'</' . $untilTag` without the trailing '>' so that
+        // optional whitespace before '>' is handled correctly, matching
+        // the behaviour of rcdata() and the HTML5 spec (§ 8.2.6.1).
+        // Entity references are NOT decoded in raw text (unlike rcdata).
+        $sequence = '</' . $this->untilTag;
+        $txt = '';
+
+        $caseSensitive = !Elements::isHtml5Element($this->untilTag);
+        while ($tok !== false &&
+            ($tok !== '<' || !$this->scanner->sequenceMatches($sequence, $caseSensitive))
+        ) {
+            $txt .= $tok;
+            $tok = $this->scanner->next();
+        }
+
+        if ($tok === false) {
+            $this->parseError('Unexpected EOF during raw text read.');
+            $this->events->text($txt);
+            $this->setTextMode(0);
+            return false;
+        }
+
+        $len = strlen($sequence);
+        $this->scanner->consume($len);
+        $len += $this->scanner->whitespace();
+        if ($this->scanner->current() !== '>') {
+            $this->parseError('Unclosed raw text end tag');
+        }
+
+        $this->scanner->unconsume($len);
+        $this->events->text($txt);
+        $this->setTextMode(0);
+
+        return $this->endTag();
+    }
+}
diff --git a/src/Sanitizer.php b/src/Sanitizer.php
@@ -17,7 +17,7 @@
 use DOMDocumentFragment;
 use DOMNode;
 use DOMNodeList;
-use Masterminds\HTML5;
+use TYPO3\HtmlSanitizer\Parser\Html5;
 use TYPO3\HtmlSanitizer\Serializer\Rules;
 use TYPO3\HtmlSanitizer\Serializer\RulesInterface;
 use TYPO3\HtmlSanitizer\Visitor\VisitorInterface;
@@ -196,8 +196,8 @@ protected function closeRulesStream(RulesInterface $rules): bool
         return fclose($rules->getStream());
     }
 
-    protected function createParser(): HTML5
+    protected function createParser(): Html5
     {
-        return new HTML5(self::mastermindsDefaultOptions);
+        return new Html5(self::mastermindsDefaultOptions);
     }
 }
diff --git a/src/Serializer/Rules.php b/src/Serializer/Rules.php
@@ -154,9 +154,8 @@ public function text($domNode): void
         if (!$domNode instanceof DOMNode) {
             return;
         }
-        // @todo if allowed as text raw element
         $parentDomNode = $domNode->parentNode ?? null;
-        if (!$this->isRawText($parentDomNode) || !$this->shallAllowInsecureRawText($parentDomNode)) {
+        if (!$this->shallAllowInsecureRawText($parentDomNode)) {
             $this->wr($this->enc($domNode->data));
             return;
         }
@@ -200,6 +199,10 @@ protected function shallAllowInsecureRawText(?DOMNode $domNode): bool
         if ($domNode === null || !$this->behavior instanceof Behavior || !$this->isRawText($domNode)) {
             return false;
         }
+        // allowing raw-text in elements nested in `<noscript>` is denied per default
+        if ($this->hasAncestorWithName($domNode, 'noscript')) {
+            return false;
+        }
         $tag = $this->behavior->getTag($domNode->nodeName);
         return $tag instanceof Behavior\Tag && $tag->shallAllowInsecureRawText();
     }
@@ -217,4 +220,19 @@ protected function isVoid(?DOMNode $domNode): bool
             && !empty($domNode->tagName)
             && Elements::isA($domNode->localName, Elements::VOID_TAG);
     }
+
+    protected function hasAncestorWithName(?DOMNode $domNode, string $ancestorName): bool
+    {
+        if (!$domNode instanceof DOMNode) {
+            return false;
+        }
+        $ancestor = $domNode->parentNode;
+        while ($ancestor instanceof DOMNode) {
+            if ($ancestor->localName === $ancestorName) {
+                return true;
+            }
+            $ancestor = $ancestor->parentNode;
+        }
+        return false;
+    }
 }
diff --git a/tests/ScenarioTest.php b/tests/ScenarioTest.php
@@ -616,6 +616,10 @@ public function attributesAreEncoded(string $payload, string $expectation): void
 
     public static function specialTagsAreHandledDataProvider(): iterable
     {
+        yield 'noscript valid' => [
+            '<noscript><p id="info">This site requires JavaScript.</p></noscript>',
+            '<noscript><p id="info">This site requires JavaScript.</p></noscript>',
+        ];
         yield 'noscript attribute' => [
             '<noscript><p id="</noscript><script>alert(1)</script>"></p>',
             '<noscript><p id="&lt;/noscript&gt;&lt;script&gt;alert(1)&lt;/script&gt;"></p></noscript>',
@@ -662,4 +666,64 @@ public function specialTagsAreHandled(string $payload, string $expectation): voi
         );
         self::assertSame($expectation, $sanitizer->sanitize($payload));
     }
+
+    public static function insecureRawTextIsSanitizedDataProvider(): \Generator
+    {
+        $noscript = new Behavior\Tag('noscript', Behavior\Tag::ALLOW_CHILDREN);
+        $styleDefault = new Behavior\Tag('style', Behavior\Tag::ALLOW_CHILDREN);
+        $styleInsecureRawText = new Behavior\Tag('style', Behavior\Tag::ALLOW_CHILDREN | Behavior\Tag::ALLOW_INSECURE_RAW_TEXT);
+        $iframeDefault = new Behavior\Tag('iframe', Behavior\Tag::ALLOW_CHILDREN);
+        $iframeInsecureRawText = new Behavior\Tag('iframe', Behavior\Tag::ALLOW_CHILDREN | Behavior\Tag::ALLOW_INSECURE_RAW_TEXT);
+
+        yield 'style whitespace closing tag is recognized (img is removed - default)' => [
+            [$styleDefault],
+            "<style>div::after{content:'<'}</style\t><img src=x onerror=alert(1)>",
+            '<style>div::after{content:\'&lt;\'}</style>',
+        ];
+        yield 'style whitespace closing tag is recognised (img is removed - insecure raw text allowed)' => [
+            [$styleInsecureRawText],
+            "<style>div::after{content:'<'}</style\t><img src=x onerror=alert(1)>",
+            '<style>div::after{content:\'<\'}</style>',
+        ];
+
+        yield 'iframe & style detect raw-text part (img is removed - insecure raw text allowed)' => [
+            [$iframeInsecureRawText, $styleInsecureRawText],
+            '<iframe><style></iframe><img src="x" onerror="alert(1)"></style></iframe>',
+            '<iframe><style></iframe>',
+        ];
+        yield 'iframe & style detect raw-text part (img is removed - default)' => [
+            [$iframeDefault, $styleDefault],
+            '<iframe><style></iframe><img src="x" onerror="alert(1)"></style></iframe>',
+            '<iframe>&lt;style&gt;</iframe>',
+        ];
+
+        yield 'noscript nesting another raw-text element is denied (content is encoded - default)' => [
+            [$noscript, $styleDefault],
+            '<noscript><style></noscript><img src=x onerror=alert(2)></style></noscript>',
+            '<noscript><style>&lt;/noscript&gt;&lt;img src=x onerror=alert(2)&gt;</style></noscript>',
+        ];
+        yield 'noscript nesting another raw-text element is denied (content is encoded - insecure raw text allowed)' => [
+            [$noscript, $styleInsecureRawText],
+            '<noscript><style></noscript><img src=x onerror=alert(2)></style></noscript>',
+            '<noscript><style>&lt;/noscript&gt;&lt;img src=x onerror=alert(2)&gt;</style></noscript>',
+        ];
+    }
+
+    /**
+     * @test
+     * @dataProvider insecureRawTextIsSanitizedDataProvider
+     */
+    public function insecureRawTextIsSanitized(array $tags, string $payload, string $expectation): void
+    {
+        $behavior = (new Behavior())
+            ->withFlags(Behavior::REMOVE_UNEXPECTED_CHILDREN)
+            ->withName('scenario-test')
+            ->withTags(...$tags);
+
+        $sanitizer = new Sanitizer(
+            $behavior,
+            new CommonVisitor($behavior)
+        );
+        self::assertSame($expectation, $sanitizer->sanitize($payload));
+    }
 }

Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@`
`17`	`17`	`use DOMDocumentFragment;`
`18`	`18`	`use DOMNode;`
`19`	`19`	`use DOMNodeList;`
`20`		`-use Masterminds\HTML5;`
	`20`	`+use TYPO3\HtmlSanitizer\Parser\Html5;`
`21`	`21`	`use TYPO3\HtmlSanitizer\Serializer\Rules;`
`22`	`22`	`use TYPO3\HtmlSanitizer\Serializer\RulesInterface;`
`23`	`23`	`use TYPO3\HtmlSanitizer\Visitor\VisitorInterface;`
`@@ -196,8 +196,8 @@ protected function closeRulesStream(RulesInterface $rules): bool`
`196`	`196`	`return fclose($rules->getStream());`
`197`	`197`	`}`
`198`	`198`
`199`		`- protected function createParser(): HTML5`
	`199`	`+ protected function createParser(): Html5`
`200`	`200`	`{`
`201`		`- return new HTML5(self::mastermindsDefaultOptions);`
	`201`	`+ return new Html5(self::mastermindsDefaultOptions);`
`202`	`202`	`}`
`203`	`203`	`}`