There is a weakness in the strip_tags function in ruby on rails.  Due to
a bug in the parsing code inside HTML::Tokenizer regarding non-printable
ascii characters, an attacker can include values which certain browsers
will then evaluate.

Versions Affected:  All versions prior to 2.3.4 or 2.2.s
Not affected:       Applications which do not use strip_tags
Fixed Versions:     2.3.5

Impact
------

Applications relying on strip_tags for XSS protection may be vulnerable
to attacks on Internet Explorer users.

Releases
--------

The 2.3.5 releases is available at the normal locations now.

Workarounds
-----------

Users using strip_tags can pass the resulting output to the regular
escaping functionality:

  <%= h(strip_tag(...)) %>

Patches
-------

To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series.  They are in git-am format
and consist of a single changeset updating the parser and providing an
additional unit test.

* 2-2-strip_tags.patch - Patch for 2.2 series
* 2-3-strip_tags.patch - Patch for 2.3 series

Please note that only the  2.2.x and 2.3.x series are supported at
present.  Users of earlier unsupported releases are advised to upgrade
at their earliest convenience.

Credits
-------
Thanks to Gabe da Silveira for reporting the vulnerability to us and
providing the fix.

--
Cheers,

Koz

[ 2-2-strip_tags.patch 2K ]
From 785281ade8c2347614525e9aceb5e62c80eec6f8 Mon Sep 17 00:00:00 2001
From: Gabe da Silveira <g...@websaviour.com>
Date: Mon, 16 Nov 2009 21:17:35 -0800
Subject: [PATCH] Make sure strip_tags removes tags which start with a non-printable character

Signed-off-by: Michael Koziarski <mich...@koziarski.com>
---
 .../vendor/html-scanner/html/node.rb               |    2 +-
 .../test/controller/html-scanner/sanitizer_test.rb |    1 +
 2 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
index 6c03316..0cd05d8 100644
--- a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
+++ b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
@@ -162,7 +162,7 @@ module HTML #:nodoc:
           end

           closing = ( scanner.scan(/\//) ? :close : nil )
-          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/)
+          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[-:\w\x00-\x09\x0b-\x0c\x0e-\x1f]+/)
           name.downcase!

           unless closing
diff --git a/actionpack/test/controller/html-scanner/sanitizer_test.rb b/actionpack/test/controller/html-scanner/sanitizer_test.rb
index bae0f5c..51baba6 100644
--- a/actionpack/test/controller/html-scanner/sanitizer_test.rb
+++ b/actionpack/test/controller/html-scanner/sanitizer_test.rb
@@ -19,6 +19,7 @@ class SanitizerTest < Test::Unit::TestCase
     assert_equal "This has a  here.", sanitizer.sanitize("This has a <!-- comment --> here.")
     assert_equal "This has a  here.", sanitizer.sanitize("This has a <![CDATA[<section>]]> here.")
     assert_equal "This has an unclosed ", sanitizer.sanitize("This has an unclosed <![CDATA[<section>]] here...")
+    assert_equal "non printable char is a tag", sanitizer.sanitize("<\x07a href='/hello'>non printable char is a tag</a>")
     [nil, '', '   '].each { |blank| assert_equal blank, sanitizer.sanitize(blank) }
   end

--
1.6.0.1

[ 2-3-strip_tags.patch 2K ]
From bfe032858077bb2946abe25e95e485ba6da86bd5 Mon Sep 17 00:00:00 2001
From: Gabe da Silveira <g...@websaviour.com>
Date: Mon, 16 Nov 2009 21:17:35 -0800
Subject: [PATCH] Make sure strip_tags removes tags which start with a non-printable character

Signed-off-by: Michael Koziarski <mich...@koziarski.com>
---
 .../vendor/html-scanner/html/node.rb               |    2 +-
 .../test/controller/html-scanner/sanitizer_test.rb |    1 +
 2 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
index 6c03316..0cd05d8 100644
--- a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
+++ b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
@@ -162,7 +162,7 @@ module HTML #:nodoc:
           end

           closing = ( scanner.scan(/\//) ? :close : nil )
-          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/)
+          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[-:\w\x00-\x09\x0b-\x0c\x0e-\x1f]+/)
           name.downcase!

           unless closing
diff --git a/actionpack/test/controller/html-scanner/sanitizer_test.rb b/actionpack/test/controller/html-scanner/sanitizer_test.rb
index e85a5c7..1923544 100644
--- a/actionpack/test/controller/html-scanner/sanitizer_test.rb
+++ b/actionpack/test/controller/html-scanner/sanitizer_test.rb
@@ -19,6 +19,7 @@ class SanitizerTest < ActionController::TestCase
     assert_equal "This has a  here.", sanitizer.sanitize("This has a <!-- comment --> here.")
     assert_equal "This has a  here.", sanitizer.sanitize("This has a <![CDATA[<section>]]> here.")
     assert_equal "This has an unclosed ", sanitizer.sanitize("This has an unclosed <![CDATA[<section>]] here...")
+    assert_equal "non printable char is a tag", sanitizer.sanitize("<\x07a href='/hello'>non printable char is a tag</a>")
     [nil, '', '   '].each { |blank| assert_equal blank, sanitizer.sanitize(blank) }
   end

--
1.6.0.1