Improper Check for Unusual or Exceptional Conditions Affecting enshrined/svg-sanitize package, versions >=1.0.0, <1.1.0

enshrined/svg-sanitize is a SVG sanitizer for PHP

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the image-set pattern in stripRemoteCssTokens() in src/Sanitizer.php. The greedy [^)}\r\n]* quantifier in the image-set regular expression causes super-linear backtracking when an SVG contains many unclosed image-set(' tokens, allowing an attacker to exhaust CPU with an input under 1 MB. Additionally, when PCRE backtrack or JIT limits are reached, preg_replace() returns null, which is passed back through stripRemoteCssReferences() and assigned to DOMNode::$textContent, causing sanitize() to throw a TypeError instead of returning false and leaving unsanitized content in place.

Note: This is only exploitable when removeRemoteReferences(true) is enabled.

Run on PHP 8.3.32 with PCRE2 10.47 and pcre.jit=1:

$s = new enshrined\svgSanitize\Sanitizer();
$s->removeRemoteReferences(true);
foreach ([20000, 30000, 40000, 50000] as $n) {
    $svg = '<svg xmlns="http://www.w3.org/2000/svg"><style>' . str_repeat("-webkit-image-set('", $n) . '</style></svg>';
    $t = microtime(true);
    try { $s->sanitize($svg); printf("%d: %.2fs\n", $n, microtime(true) - $t); }
    catch (Throwable $e) { printf("%d: %s: %s\n", $n, get_class($e), $e->getMessage()); }
}

Measured:

The style attribute form behaves the same way up to a point: <rect style="..."> takes 3.98 s at 30000. At 50000 the attribute is dropped, so it fails safe there.

The thresholds depend on the PCRE build, pcre.backtrack_limit and the JIT stack size. The quadratic shape does not.

Note: Run on PHP 8.3.32 with PCRE2 10.47 and pcre.jit=1.

• GitHub Advisory
• GitHub Commit