Hackerone Reports on Telegram: “🎯 New Report #3601655: Rails::HTML::Sanitizer.a…”

🎯 New Report #3601655: Rails::HTML::Sanitizer.allowed uri? returns true for entity-encoded control-character-split javascript: URLs
🔺Severity: Low
👽 Reporter: smlee
⭐️ Reputation: 143
🛠 State: resolved
💼 Team: Ruby on Rails
💵 Bounty: null
🕐 Submitted: 2026-03-12
⏰ Disclosed: 2026-04-18 15:27:19
📝 Summary: A vulnerability was discovered in the Rails::HTML::Sanitizer.allowed uri? method of the rails-html-sanitizer library. The method incorrectly returned true for entity-encoded control-character-split javascript: URLs, which could lead to potential security issues if the application relied on the method's result to make security decisions.
📂 Report JSON File: 3601655
@hackeronereports