GHSA-gj48-438w-jh9v — Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes

Affected: PyPI: bleach

### Summary

Bleach `clean()` / `Cleaner()` fails to sanitize dangerous URI schemes in allowed `formaction` attributes.

Bleach applies URI protocol sanitization only to attributes listed in `attr_val_is_uri`. While URI-bearing attributes such as `action`, `href`, `src`, and `poster` are included in that set, `formaction` is not. As a result, if a downstream application explicitly allows `formaction` on submit-capable controls in untrusted HTML, Bleach preserves dangerous values such as `javascript:alert(1)` instead of stripping them.

This can lead to **submit-triggered JavaScript execution** in applications that rely on Bleach to sanitize untrusted HTML and allow the relevant tag/attribute combination.

---

### Details

The issue appears to be a URI-sanitization coverage gap in Bleach’s sanitizer logic.

Relevant code paths:

* `bleach/sanitizer.py` — `BleachSanitizerFilter.allow_token` (around line 553) * `bleach/_vendor/html5lib/filters/sanitizer.py` — `attr_val_is_uri` (around line 525)

In `BleachSanitizerFilter.allow_token`, URI protocol sanitization is only applied when:

```python id="pft79m" if namespaced_name in self.attr_val_is_uri: ```

However, `(None, 'formaction')` is currently missing from `attr_val_is_uri`.

This creates an inconsistency where `action` is protocol-sanitized, but `formaction` is not.

As a result, if a downstream application allows:

* tags such as `<button>` or `<input>` * the `formaction` attribute

then Bleach preserves dangerous URI sch…

Most recent entries from all

GHSA-gj48-438w-jh9v — Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes