GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Strip control chars from URLs in jsoup StringUtil by Chandan3456 · Pull Request #323 · itext/itext-java

Conversation

@Chandan3456

@Chandan3456 Chandan3456 commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

the jsoup port's Cleaner checks allowed protocols against the url resolved by StringUtil.resolve, but java.net.URL keeps ascii control characters that browsers strip, so the check and the browser disagree on the scheme. with Safelist.basic().preserveRelativeLinks(true), resolves relative to the base url, passes the protocol check, and the raw value survives cleaning; a browser then strips the tab and runs javascript:alert(1). same for CR/LF and / entity variants. this is CVE-2022-36033, fixed upstream in jsoup 1.15.3 (jhy/jsoup@4ea768d); this ports that fix to the vendored copy by stripping ascii 0x00-0x1f from urls in StringUtil.resolve before resolution. the ported regression tests fail before the change and pass after, and the styled-xml-parser and svg unit suites stay green.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@Chandan3456
Strip control chars from URLs in jsoup StringUtil
e366afa 
The jsoup Cleaner validates link protocols against the resolved
absolute URL, but java.net.URL keeps ASCII control characters that
browsers strip, so the check and the browser can disagree about the
scheme. With Safelist.preserveRelativeLinks(true) an href such as
java&itext#9;script:alert(1) passes the protocol check and is kept as is
in the sanitized output, where a browser strips the tab and runs it
as javascript: (CVE-2022-36033 in upstream jsoup). Port the jsoup
1.15.3 fix (jhy/jsoup@4ea768d): remove ASCII control characters
from URLs in StringUtil.resolve before resolution.
@iText-CI

iText-CI commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vitali-pr

vitali-pr commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

@Chandan3456 , indeed, we have in near plans to update our port to the latest jsoup version where we will address all known vulnerabilities in one go.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@Chandan3456 @iText-CI @vitali-pr
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.