Homepage

bleach@3.2.0

An easy safelist-based HTML-sanitizing tool.

  • latest version

    6.4.0

  • first published

    16 years ago

  • latest version published

    4 months ago

  • licenses detected

  • View bleach package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the bleach package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Regular Expression Denial of Service (ReDoS)

    bleach is a whitlist-based HTML sanitizing library that escapes or strips markup and attributes.

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the LinkifyFilter.handle_email_addresses() function. An attacker can cause excessive CPU consumption by submitting specially crafted large non-email input to the email linkification path when the parse_email option is enabled. This is only exploitable if the consuming application enables the parse_email=True option and allows untrusted user input of sufficient size to reach the linkification process without input limits or timeouts.

    How to fix Regular Expression Denial of Service (ReDoS)?

    There is no fixed version for bleach.

    [0,)
    • L
    Incomplete List of Disallowed Inputs

    bleach is a whitlist-based HTML sanitizing library that escapes or strips markup and attributes.

    Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the bleach.clean() function when processing URIs containing disallowed scheme patterns with inserted Unicode characters. An attacker can cause the sanitizer to output URIs that violate the intended protocol allowlist by crafting links with non-ASCII characters in the scheme portion. If a downstream system performs Unicode normalization on the output, this could enable execution of unintended scripts.

    How to fix Incomplete List of Disallowed Inputs?

    Upgrade bleach to version 6.4.0 or higher.

    [,6.4.0)
    • M
    Cross-site Scripting (XSS)

    bleach is a whitlist-based HTML sanitizing library that escapes or strips markup and attributes.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the clean() function. An attacker can execute arbitrary JavaScript code in the context of the user's browser by submitting crafted HTML containing a formaction attribute with a dangerous URI scheme such as javascript:. This is only exploitable if the application explicitly allows the formaction attribute on submit-capable controls such as <button> or <input> elements.

    How to fix Cross-site Scripting (XSS)?

    Upgrade bleach to version 6.4.0 or higher.

    [,6.4.0)
    • M
    Cross-site Scripting (XSS)

    bleach is a whitlist-based HTML sanitizing library that escapes or strips markup and attributes.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). A mutation XSS affects users calling bleach.clean when svg or math, p or br , and style are in the allowed tags, and the keyword argument is set strip_comments=False

    Note: none of the above tags are in the default allowed tags and strip_comments is set to True by default.

    Workarounds

    modify bleach.clean calls to either not allow the style tag, not allow svg or math tags, not allow p or br tags, and/or set strip_comments=True

    A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.

    How to fix Cross-site Scripting (XSS)?

    Upgrade bleach to version 3.3.0 or higher.

    [,3.3.0)
    Go back to all versions of this package