Merge branch '7.4' into 8.0

* 7.4:
  fix merge
  [FrameworkBundle] Remove extra argument from ContainerBuilder::willBeAvailable call
  fix ext-redis 6.2.0 compatibility
  [CssSelector] Fix incorrect return type for Token::getType()
  [Workflow] State contamination due to class-based setter cache
  fix: fixed State contamination in marking stores due to class-based getter cache
  [Validator] Fix call to undefined getParser() in YamlValidator
  [ObjectMapper] Update Map attribute PHPDoc to match TransformCallableInterface signature
  fix tests
  Fix contentId assignment for inline attachments
  [HtmlSanitizer] Remove `srcdoc` from allowed attributes
  [EventDispatcher][FrameworkBundle] Rework union types on `#[AsEventListener]`

Author: xabbuh

Reference/W3CReference.php

@@ -368,7 +368,7 @@ final class W3CReference
         'span' => true,
         'spellcheck' => true,
         'src' => true,
-        'srcdoc' => true,
+        // 'srcdoc' => false, // XSS vector if not properly sandboxed, should be enabled explicitly with ->allowAttribute('srcdoc', 'iframe')->forceAttribute('iframe', 'sandbox', '')
         'srclang' => true,
         'srcset' => true,
         'standby' => true,

Tests/Fixtures/baseline-attribute-allow-list.json

@@ -182,7 +182,6 @@
   "span",
   "spellcheck",
   "src",
-  "srcdoc",
   "srclang",
   "srcset",
   "standby",

Tests/HtmlSanitizerAllTest.php

@@ -590,6 +590,23 @@ public static function provideSanitizeHtml(): iterable
         ];
     }
 
+    public function testIFrameDefaultsAreSafe()
+    {
+        $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())
+            ->allowElement('iframe', '*')
+        );
+        $input = '<iframe src="javascript:alert()" onload="alert()" srcdoc="<script>alert()</script>">XSS</iframe>';
+        $this->assertSame('<iframe>XSS</iframe>', $sanitizer->sanitize($input));
+
+        $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())
+            ->allowElement('iframe', '*')
+            ->allowAttribute('srcdoc', 'iframe')
+            ->forceAttribute('iframe', 'sandbox', '')
+        );
+        $input = '<iframe src="javascript:alert()" onload="alert()" srcdoc="<script>alert()</script>">XSS-prevented by sandbox</iframe>';
+        $this->assertSame('<iframe srcdoc="&lt;script&gt;alert()&lt;/script&gt;" sandbox>XSS-prevented by sandbox</iframe>', $sanitizer->sanitize($input));
+    }
+
     public function testUnlimitedLength()
     {
         $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())->withMaxInputLength(-1));

Tests/HtmlSanitizerConfigTest.php

@@ -109,7 +109,7 @@ public function testAllowElementStandardAttributes()
         $config = new HtmlSanitizerConfig();
         $config = $config->allowElement('div', '*');
         $this->assertSame(['div'], array_keys($config->getAllowedElements()));
-        $this->assertCount(211, $config->getAllowedElements()['div']);
+        $this->assertCount(210, $config->getAllowedElements()['div']);
         $this->assertSame([], $config->getBlockedElements());
     }