GHSA-CJ75-F6XR-R4G7: Root-cause Fix for SVG href Sanitization Bypass

Vulnerability

In custom rails-html-sanitizer configurations that explicitly allowed SVG reference tags and related attributes, the sanitizer enforced the SVG local-reference rule only for xlink:href. Plain href on SVG elements such as <use> was not subjected to the same restriction, allowing external references to survive sanitization. Per the advisory, this enabled XSS and tracking behaviors when applications permitted these SVG constructs. The issue is documented in the official advisory and fixed in the upstream commit: GHSA advisory, patch commit.

The vulnerable condition was narrowly keyed to xlink:href, so equivalent payloads using href bypassed the scrubber path intended for SVG elements that should only reference local fragments such as #id.

if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#\s].*/m

Patch

The patch corrects the attribute-selection logic by replacing the single-name check with Loofah's broader SVG href attribute set. This makes the local-reference restriction apply to both href and xlink:href where appropriate. The change is in lib/rails/html/scrubbers.rb and is paired with a dependency floor increase to loofah >= 2.25.2 in both Gemfile.lock and the gemspec: commit details.

if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) && attr_node.value =~ /^\s*[^#\s].*/m

The dependency update is security-relevant because the sanitizer now relies on the Loofah safelist constant that models the applicable SVG href-like attributes. The patch also adds regression tests proving that local fragment references are preserved while external references are removed for both attribute forms, including a leading-newline variant for href.

Review

Pros

• The fix addresses the actual trust-boundary mistake: the sanitizer was checking the wrong attribute set, not merely missing a single test case.
• Using Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES is more robust than hard-coding xlink:href, because it aligns rails-html-sanitizer behavior with the upstream safelist model in Loofah.
• The patch preserves intended safe behavior for local fragment references while stripping external URLs, matching the documented security expectation for SVG reference elements.
• Regression coverage is strong for the reported bypass shape: tests cover xlink:href, plain href, allowed local references, blocked external references, and whitespace-prefixed input.
• The gemspec and lockfile updates reduce version skew by ensuring consumers resolve a Loofah version compatible with the new logic.

Cons

• The fix is scoped to configurations that allow SVG tags/attributes; it does not change the broader risk profile of applications that over-permit SVG content.
• The tests shown focus on <use>; while the code uses SVG_ALLOW_LOCAL_HREF, the patch summary does not enumerate additional element-level cases in test coverage.
• The regex-based external-reference detection remains implementation-sensitive; although the newline case is covered, the reviewable sources do not show broader normalization tests beyond the added cases.

Verdict

Root-cause.

This is a proper root-cause fix because it corrects the sanitizer's attribute classification logic from a single hard-coded name to the safelist-defined set of SVG href attributes. That directly closes the bypass where href escaped a restriction intended for SVG local references. The accompanying dependency pin to loofah >= 2.25.2 and the added regression tests make the remediation coherent and source-grounded rather than superficial. See the official sources for the advisory and patch: GHSA advisory, upstream commit, and contextual reporting at CVE Reports.