MEDIUM
GHSA-p2g9-94wh-65c2
Space bug in `clean_text`
Details
An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
let html = format!("<div title={}>", clean_text(user_supplied_string));
Applications are not affected if they quote their attributes, or if they don't use `clean_text` at all.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/ammonia
Introduced in:
3.0.0Fixed in: 3.1.3Upgrade ammonia to 3.1.3 or newer (ecosystem crates.io).