Restricted HTML filtering bypass (XSS) via HTML comments

Steps to reproduce:

Filter the input

<!--> <Details Open OnToggle=confirm("XSS")>

in restricted mode (in XWiki, e.g., put the code in an HTML macro as a user without script right or in a comment).

Expected result:

Either the ontoggle parameter is removed or the whole content is interpreted as a comment without starting <.

Actual result:

<!--> <Details Open OnToggle=confirm("XSS")>-->

In the context of a browser a confirmation message "XSS" is displayed.

The reason for this is that HtmlCleaner parses <!--> as the start of an HTML comment while browsers (correctly) parse this as an empty comment. The reason for this is that HTML comments must not start with >.

This issue has also been reported to HtmlCleaner as bug 234.

This security issue only exists since XWiki 14.6RC1 as only since XCOMMONS-1680 HTML attributes are actually filtered to prevent XSS.