GHSA-whqh-9pq5-c7r3

Summary

The SvgSanitizer::decodeAllEntities() method limits recursive entity decoding to 5 iterations. By wrapping each character of javascript in an href attribute value with 5 levels of & encoding around numeric HTML entities (e.g., j for j), an attacker can bypass both isSafe() detection and sanitize() removal. The uploaded SVG is served from the application origin with image/svg+xml content type, and the browser's XML parser fully decodes the remaining &#NNN; entities, resulting in a clickable javascript: link that executes arbitrary JavaScript.

Details

Root cause: decodeAllEntities() at phpmyfaq/src/phpMyFAQ/Helper/SvgSanitizer.php:223-249 limits entity decoding to maxIterations=5. Each iteration: (1) decodes &#NNN; numeric entities, (2) decodes &#xHH; hex entities, (3) calls html_entity_decode() which resolves one level of & → &. With 5 levels of & wrapping, all 5 iterations are consumed unwinding the & nesting, leaving the final &#NNN; numeric entities unresolved.

Code path:

1. Authenticated user with FAQ_EDIT permission uploads SVG via POST /admin/api/content/images (ImageController::upload() at line 39)
2. File extension is svg → SvgSanitizer::isSafe() called (line 114)
3. isSafe() calls decodeAllEntities() — 5 iterations resolve & nesting but leave ja... (numeric entities for javascript)
4. Pattern matching at line 47 (/href\s*=\s*["\'][\s]*javascript\s*:/i) does not match ja...
5. isSafe() returns true — file saved without any sanitization
6. SVG served directly by web server from content/user/images/ with image/svg+xml MIME type
7. Browser's XML parser decodes j → j, a → a, etc., reconstructing javascript:alert(document.domain)
8. User clicks the SVG link → JavaScript executes in the phpMyFAQ origin

The bypass is even simpler than initially described — no <script>...