DOMPurify ADD_ATTR predicate skips URI validation

Summary DOMPurify allows ADDATTR to be provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. When the predicate returns true, isValidAttribute short-circuits the attribute check before URI-safe validation runs. An attacker who supplies a predicate that accepts specific...

PT-2019-11168

Name of the Vulnerable Software and Affected Versions: Android versions 7.0 through 9 Description: The issue is related to a missing bounds check in the add attr function of sdp discovery.c, which could lead to a possible out of bounds read. This may result in remote information disclosure withou...