Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
## Summary Graby's `cleanupXss()` function configures htmLawed with conflicting settings: `safe=1` (which removes `<iframe>`) combined with `'elements' => '*+iframe-meta'` (which re-enables `<iframe>`). htmLawed does not sanitize the `srcdoc` attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via `|raw` in templates. ## Root Cause **`src/Graby.php` lines 1038-1048:** ```php htmLawed($html, [ 'safe' => 1, // removes <iframe> 'elements' => '*+iframe-meta', // re-adds <iframe>, overrides safe=1 'deny_attribute' => 'style', // srcdoc is NOT denied ]); ``` The `sa
- Обновитесь до 2.5.1
Опубликовано Обновлено