# ActionView sanitize helper bypass with noscript

Rails::HTML::Sanitizer 1.6.0 fails to sanitize noscript content, letting crafted markup break out and inject script tags for XSS.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: taise
- Disclosed: 2025-02-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2931691
- Library page: https://bugbountylibrary.com/r/h1%3A2931691
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:ruby technique:parser-differential vuln:xss

**Target:** Rails ActionView sanitize helper / rails-html-sanitizer
**Root cause:** The sanitizer's handling of noscript elements fails to properly parse/escape their contents, allowing an attacker to break out of an attribute context and inject a script tag.
**Steps:**
1. Render `sanitize '<noscript><p id="</noscript><script>alert(1)</script>">"</noscript>'` in a Rails view with noscript allowed
2. Sanitizer emits the noscript content without neutralizing the embedded `</noscript><script>` sequence
3. Browser parses the injected `<script>alert(1)</script>` and executes it
**Exploitation:** Attacker supplies crafted HTML containing a noscript element with a closing tag inside an attribute value, which survives sanitization and results in script execution in the victim's browser.
**Insight:** When a sanitizer allowlists elements like noscript whose content model is raw text, test whether closing tags embedded inside attribute values can terminate the element early and smuggle script tags past the filter.