diff --git a/CHANGES.md b/CHANGES.md index 662ee46c..cacf36fb 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -4,6 +4,7 @@ - [pull #687] Fix AssertionError hashing HTML blocks spread over multiple lines (#686) - [pull #692] Fix XSS from code spans in link titles (#691) +- [pull #695] Fix XSS issue from incomplete tags with no attributes (#694) ## python-markdown2 2.5.5 diff --git a/lib/markdown2.py b/lib/markdown2.py index 138e804d..ea08820f 100755 --- a/lib/markdown2.py +++ b/lib/markdown2.py @@ -2215,7 +2215,7 @@ def _encode_amps_and_angles(self, text: str) -> str: text = self._naked_gt_re.sub('>', text) return text - _incomplete_tags_re = re.compile(r"\\*<(!--|/?\w+?(?!\w)\s*?.+?(?:[\s/]+?|$))") + _incomplete_tags_re = re.compile(r"\\*<(!--|/?\w+?(?!\w)\s*?.*?(?:[\s/]+?|$))") def _encode_incomplete_tags(self, text: str) -> str: if self.safe_mode not in ("replace", "escape"): diff --git a/test/tm-cases/incomplete_tag_xss_issue694.html b/test/tm-cases/incomplete_tag_xss_issue694.html new file mode 100644 index 00000000..34fe52ad --- /dev/null +++ b/test/tm-cases/incomplete_tag_xss_issue694.html @@ -0,0 +1,2 @@ +

<iframe +<http:> srcdoc="<script>alert()</script>" a=

diff --git a/test/tm-cases/incomplete_tag_xss_issue694.opts b/test/tm-cases/incomplete_tag_xss_issue694.opts new file mode 100644 index 00000000..de64198e --- /dev/null +++ b/test/tm-cases/incomplete_tag_xss_issue694.opts @@ -0,0 +1 @@ +{'safe_mode': 'escape'} \ No newline at end of file diff --git a/test/tm-cases/incomplete_tag_xss_issue694.text b/test/tm-cases/incomplete_tag_xss_issue694.text new file mode 100644 index 00000000..0ed4c984 --- /dev/null +++ b/test/tm-cases/incomplete_tag_xss_issue694.text @@ -0,0 +1,2 @@ +