GHSA-PQ4G-8RXF-4G29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...