Uncaught Exception Affecting enshrined/svg-sanitize package, versions >=1.1.0, <1.1.1

enshrined/svg-sanitize is a SVG sanitizer for PHP

Affected versions of this package are vulnerable to Uncaught Exception via sanitize() when processing SVG input that ends inside an unclosed tag. The pre-parsing checks hasElementWithTooManyAttributes() and hasInternalDtdSubset() in src/Sanitizer.php advance their scan offset one past the end of the string when the input is truncated, causing the subsequent strpos() call to throw an uncaught ValueError on PHP 8. Because both checks run before the try block in sanitize(), input as short as a single < escapes any exception handling and crashes the request. On PHP 7 the same input raises a warning and returns false, but an error handler that promotes warnings to exceptions is also affected.

With 1.1.0 and the default settings:

<?php
require 'vendor/autoload.php';

use enshrined\svgSanitize\Sanitizer;
var_dump((new Sanitizer())->sanitize('<'));

On PHP 8.5.11 it prints:

Fatal error: Uncaught ValueError: strpos(): Argument #3 ($offset) must be contained in argument #1 ($haystack) in src/Sanitizer.php:770
Stack trace:
#0 src/Sanitizer.php(770): strpos('<', '<', 2)

<a, <svg, <svg></svg>< and any SVG cut inside a tag, like <svg xmlns="http://www.w3.org/2000/svg"><rect width="10", fail on the same line.

The DOCTYPE case throws the same ValueError from src/Sanitizer.php:731:

var_dump((new Sanitizer())->sanitize("\xFF\xFE" . mb_convert_encoding('<!DOCTYPE svg', 'UTF-16LE', 'UTF-8')));

This is what I got for both inputs, all with libxml 2.9.13:

Note: Tested on PHP 8.5.11 with libxml 2.9.13 and version 1.1.0 using default settings.

• GitHub Advisory
• GitHub Commit