Impact

strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected.

Details

strip_tags now encodes " and ' in its output, as well as &, < and >, without double-encoding existing entities. Applications that use strip_tags output outside HTML, such as in a text template or JSON, now see " and ' where they saw " and '; CGI.unescapeHTML decodes them. See the Action View CHANGELOG.

Workarounds

Pass strip_tags output to an attribute through a tag helper, which escapes attribute values, for example tag.a(title: strip_tags(user_input)).

Releases

The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:

• 8.1: https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch
• 8.0: https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch

Credit

This issue was responsibly reported by HackerOne researcher lucasluitjes.