GHSA-wwpr-jff3-395c: Crass: A large number of adjacent CSS comments can trigger a SystemStackError
Impact
When the :preservecomments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.
Patches
This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.
Workarounds
Set the :preservecomments option to true if this is acceptable to your use case (recursion doesn't occur when comments are preserved).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Set the :preserve_comments option to true to prevent recursion when discarding CSS comments.
Crass :preserve_comments = true
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use Crass to parse attacker-controlled or otherwise untrusted CSS are exposed when comment preservation is disabled. This is the default behavior when the :preserve_comments option is not enabled.
What input is required to trigger the failure?
An attacker needs to supply a stylesheet containing a very large number of adjacent CSS comments. Processing those comments can cause excessive recursion and raise a SystemStackError.
What can be done if upgrading is not immediately possible?
Set the :preserve_comments option to true, if preserving comments is acceptable for the application. With comments preserved, the vulnerable recursive comment-discarding behavior does not occur.
Which version fixes the issue?
Crass 1.0.7 fixes the issue by no longer using recursion when discarding comments.