Merge pull request #700 from Crozzers/fix-xss-699

Fix XSS from code spans in image alt text (#699)

Author: nicholasserra

CHANGES.md

@@ -5,6 +5,7 @@
 - [pull #687] Fix AssertionError hashing HTML blocks spread over multiple lines (#686)
 - [pull #692] Fix XSS from code spans in link titles (#691)
 - [pull #695] Fix XSS issue from incomplete tags with no attributes (#694)
+- [pull #700] Fix XSS from code spans in image alt text (#699)
 
 
 ## python-markdown2 2.5.5

lib/markdown2.py

@@ -3279,6 +3279,10 @@ def run(self, text: str):
                     curr_pos = start_idx + 1
                     continue
 
+                if link_text and self.md.safe_mode:
+                    # expose code span contents for escaping - fix #699
+                    link_text = self.md._unhash_html_spans(link_text, spans=False, code=True)
+
                 start_idx -= 1
                 result, skip = self.process_image(url, title_str, link_text)
             elif start_idx >= anchor_allowed_pos:

test/tm-cases/xss_issue699.html

@@ -0,0 +1 @@
+<p><img src="" alt="&lt;code&gt;&quot; onerror=&quot;alert(1)//&lt;/code&gt;" /></p>

test/tm-cases/xss_issue699.opts

@@ -0,0 +1 @@
+{"safe_mode": "escape"}

test/tm-cases/xss_issue699.text

@@ -0,0 +1 @@
+![`" onerror="alert(1)//`]()