From 59bbf504cf1c6205c56c9c0d6c9e3c6154904ecc Mon Sep 17 00:00:00 2001
From: Dan Brown <development@danb.me>
Date: Tue, 30 Jun 2026 18:35:34 +0100
Subject: [PATCH] Content filtering: Added srcset protocol filter

Upstream libraries used did not specifically treat values in srcset as
URIs like other attributes, so this adds a simple filter for possible
bad values.
Updated tests to cover.

Thanks for Gurmandeep Deol for reporting.
---
 .../HtmlPurifier/ConfiguredHtmlPurifier.php   |  4 +++
 .../Filters/UriLimitFileProtocolToAnchors.php |  2 --
 app/Util/HtmlPurifier/SrcsetAttrDef.php       | 26 +++++++++++++++++++
 tests/Entity/PageContentFilteringTest.php     |  3 +++
 4 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 app/Util/HtmlPurifier/SrcsetAttrDef.php

diff --git a/app/Util/HtmlPurifier/ConfiguredHtmlPurifier.php b/app/Util/HtmlPurifier/ConfiguredHtmlPurifier.php
index 87ed5add2..173935903 100644
--- a/app/Util/HtmlPurifier/ConfiguredHtmlPurifier.php
+++ b/app/Util/HtmlPurifier/ConfiguredHtmlPurifier.php
@@ -156,6 +156,10 @@ class ConfiguredHtmlPurifier
 
         // Allow mention-ids on links
         $definition->addAttribute('a', 'data-mention-user-id', 'Number');
+
+        // Set up custom handler for srcset to limit accepted types
+        $definition->addAttribute('img', 'srcset', new SrcsetAttrDef());
+        $definition->addAttribute('source', 'srcset', new SrcsetAttrDef());
     }
 
     protected function configureUriDefinition(HTMLPurifier_URIDefinition $definition): void
diff --git a/app/Util/HtmlPurifier/Filters/UriLimitFileProtocolToAnchors.php b/app/Util/HtmlPurifier/Filters/UriLimitFileProtocolToAnchors.php
index 19ca9cc82..bf259e083 100644
--- a/app/Util/HtmlPurifier/Filters/UriLimitFileProtocolToAnchors.php
+++ b/app/Util/HtmlPurifier/Filters/UriLimitFileProtocolToAnchors.php
@@ -51,5 +51,3 @@ class UriLimitFileProtocolToAnchors extends HTMLPurifier_URIFilter
         return false;
     }
 }
-
-// vim: et sw=4 sts=4
diff --git a/app/Util/HtmlPurifier/SrcsetAttrDef.php b/app/Util/HtmlPurifier/SrcsetAttrDef.php
new file mode 100644
index 000000000..3b8417a55
--- /dev/null
+++ b/app/Util/HtmlPurifier/SrcsetAttrDef.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace BookStack\Util\HtmlPurifier;
+
+use HTMLPurifier_AttrDef;
+
+/**
+ * Custom attribute definition to filter out potentially dangerous
+ * values from the srcset attribute.
+ */
+class SrcsetAttrDef extends HTMLPurifier_AttrDef
+{
+    public function validate($string, $config, $context)
+    {
+        $lower = strtolower($string);
+        $nonAllowed = ['javascript:', 'vbscript:', 'data:', 'file:'];
+
+        foreach ($nonAllowed as $nonAllowedString) {
+            if (str_contains($lower, $nonAllowedString)) {
+                return false;
+            }
+        }
+
+        return $string;
+    }
+}
diff --git a/tests/Entity/PageContentFilteringTest.php b/tests/Entity/PageContentFilteringTest.php
index 0ebbd9a0e..5cb898e05 100644
--- a/tests/Entity/PageContentFilteringTest.php
+++ b/tests/Entity/PageContentFilteringTest.php
@@ -469,6 +469,9 @@ HTML;
             '<object data="file://link/to/file" id="bkmrk-file-object"></object>' => '<object id="bkmrk-file-object">',
             '<div id="bkmrk-file-img"><img src="file://link/to/file" alt="My local image"></div>' => '<div id="bkmrk-file-img"></div>',
             '<div id="bkmrk-file-img"><img srcset="file://link/to/file" alt="My local image"></div>' => '<div id="bkmrk-file-img"></div>',
+            '<div id="bkmrk-file-img"><img src="http://example.com" srcset="file://link/to/file  2x" alt="My local image"></div>' => '<div id="bkmrk-file-img"><img src="http://example.com" alt="My local image"></div>',
+            '<div id="bkmrk-file-img"><picture><source srcset="file://link/to/file"/><img src="http://example.com" alt="cat"/></picture></div>' => '<div id="bkmrk-file-img"><picture><source><img src="http://example.com" alt="cat"></picture></div>',
+            '<div id="bkmrk-link"><link rel="preload" as="image" imagesizes="50vw" imagesrcset="file://cat.com, bg-wide.png 800w" /></div>' => '<div id="bkmrk-link"></div>',
         ];
 
         config()->set('app.content_filtering', 'a');