Merge pull request #586 from Crozzers/xss-fix

Fix #583 by tweaking incomplete tag regex

Author: nicholasserra

lib/markdown2.py

@@ -2342,7 +2342,7 @@ def _encode_amps_and_angles(self, text: str) -> str:
         text = self._naked_gt_re.sub('>', text)
         return text
 
-    _incomplete_tags_re = re.compile(r"<(!--|/?\w+?(?!\w)\s*?.+?[\s/]+?)")
+    _incomplete_tags_re = re.compile(r"<(!--|/?\w+?(?!\w)\s*?.+?(?:[\s/]+?|$))")
 
     def _encode_incomplete_tags(self, text: str) -> str:
         if self.safe_mode not in ("replace", "escape"):

test/tm-cases/issue341_xss.html

@@ -1,5 +1,5 @@
 <p>Example 1:
-<ftp:<a href="#">[HTML_REMOVED]alert(1);//</a>&gt;<ftp:<a href="#">[HTML_REMOVED]</a>&gt;</p>
+&lt;ftp:<a href="#">[HTML_REMOVED]alert(1);//</a>&gt;&lt;ftp:<a href="#">[HTML_REMOVED]</a>&gt;</p>
 
 <p>Example 2:
 &lt;http://g<!s://q?<!-&lt;<a href="http://g">[HTML_REMOVED]alert(1);/\*</a>->a>&lt;http://g<!s://g.c?<!-&lt;<a href="http://g">a\\*/[HTML_REMOVED]alert(1);/*</a>->a></p>

test/tm-cases/issue583_xss.html

@@ -0,0 +1 @@
+<p>&lt;img onerror=alert("hi")[HTML_REMOVED] src=a</p>

test/tm-cases/issue583_xss.opts

@@ -0,0 +1 @@
+{'safe_mode': 'replace'}

test/tm-cases/issue583_xss.text

@@ -0,0 +1 @@
+<img onerror=alert("hi")<a> src=a