From f2330237440df7e8f39c3ad1b1aa8852be3b27c0
From: Stefan Behnel <stefan_ml@behnel.de>
Date: Thu Nov 11 13:21:08 2021 +0100
      Sat, 4 Aug 2018 12:56:14 +0200
Subject: [PATCH] Cleaner: Remove SVG image data URLs since they can embed 
 script content.
    
Reported as GHSL-2021-1038
CVE-2021-43818

---
 src/lxml/html/clean.py            |   22 ++++++++++++++---
 src/lxml/html/tests/test_clean.py |   49 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 3 deletions(-)

Index: lxml-2.3.6/src/lxml/html/clean.py
===================================================================
--- lxml-2.3.6.orig/src/lxml/html/clean.py
+++ lxml-2.3.6/src/lxml/html/clean.py
@@ -82,11 +82,16 @@ _looks_like_tag_content = re.compile(
 
 # All kinds of schemes besides just javascript: that can cause
 # execution:
-_is_javascript_scheme = re.compile(
-    r'(?:javascript|jscript|livescript|vbscript|data|about|mocha):',
-    re.I).search
+_is_possibly_malicious_scheme = re.compile(
+    r'(javascript|jscript|livescript|vbscript|data|about|mocha):',
+    re.I).findall
+# SVG images can contain script content
+_is_unsafe_image_type = re.compile(r"(xml|svg)", re.I).findall
+
 _substitute_whitespace = re.compile(r'[\s\x00-\x08\x0B\x0C\x0E-\x19]+').sub
 # FIXME: should data: be blocked?
+_find_image_dataurls = re.compile(
+    r'^data:image/(.+);base64,', re.I).findall
 
 # FIXME: check against: http://msdn2.microsoft.com/en-us/library/ms537512.aspx
 _conditional_comment_re = re.compile(
@@ -100,6 +105,17 @@ _find_external_links = etree.XPath(
      "descendant-or-self::x:a[normalize-space(@href) and substring(normalize-space(@href),1,1) != '#']"),
     namespaces={'x':XHTML_NAMESPACE})
 
+def _is_javascript_scheme(s):
+   is_image_url = False
+   for image_type in _find_image_dataurls(s):
+       is_image_url = True
+       if _is_unsafe_image_type(image_type):
+           return True
+   if is_image_url:
+       return False
+   return bool(_is_possibly_malicious_scheme(s))
+
+
 class Cleaner(object):
     """
     Instances cleans the document of each of the possible offending
Index: lxml-2.3.6/src/lxml/html/tests/test_clean.py
===================================================================
--- lxml-2.3.6.orig/src/lxml/html/tests/test_clean.py
+++ lxml-2.3.6/src/lxml/html/tests/test_clean.py
@@ -1,3 +1,5 @@
+import base64
+import gzip
 import unittest, sys
 from lxml.tests.common_imports import make_doctest
 from lxml.etree import LIBXML_VERSION
@@ -70,6 +72,53 @@ class CleanerTest(unittest.TestCase):
             cleaner.clean_html(html))
 
 
+    @unittest.skipIf(sys.version_info[:2] < (3, 3),
+                     "gzip.compress is available in >=3.2"
+    )
+    def test_svg_data_links(self):
+        # Remove SVG images with potentially insecure content.
+        svg = b'<svg onload="alert(123)" />'
+        svgz = gzip.compress(svg)
+        svg_b64 = base64.b64encode(svg).decode('ASCII')
+        svgz_b64 = base64.b64encode(svgz).decode('ASCII')
+        urls = [
+            "data:image/svg+xml;base64," + svg_b64,
+            "data:image/svg+xml-compressed;base64," + svgz_b64,
+        ]
+        for url in urls:
+            html = '<img src="%s">' % url
+            s = lxml.html.fragment_fromstring(html)
+
+            cleaned = lxml.html.tostring(clean_html(s))
+            self.assertEqual(
+                b'<img src="">',
+                cleaned,
+                "%s  ->  %s" % (url, cleaned))
+
+    def test_image_data_links(self):
+        data = b'123'
+        data_b64 = base64.b64encode(data).decode('ASCII')
+        urls = [
+            "data:image/jpeg;base64," + data_b64,
+            "data:image/apng;base64," + data_b64,
+            "data:image/png;base64," + data_b64,
+            "data:image/gif;base64," + data_b64,
+            "data:image/webp;base64," + data_b64,
+            "data:image/bmp;base64," + data_b64,
+            "data:image/tiff;base64," + data_b64,
+            "data:image/x-icon;base64," + data_b64,
+        ]
+        for url in urls:
+            html = '<img src="%s">' % url
+            s = lxml.html.fragment_fromstring(html)
+
+            cleaned = lxml.html.tostring(clean_html(s))
+            self.assertEqual(
+                html.encode("UTF-8"),
+               cleaned,
+                "%s  ->  %s" % (url, cleaned))
+
+
 def test_suite():
     suite = unittest.TestSuite()
     if sys.version_info >= (2,4):
