GHSA-gj48-438w-jh9v

### Summary Bleach `clean()` / `Cleaner()` fails to sanitize dangerous URI schemes in allowed `formaction` attributes. Bleach applies URI protocol sanitization only to attributes listed in `attr_val_is_uri`. While URI-bearing attributes such as `action`, `href`, `src`, and `poster` are included in that set, `formaction` is not. As a result, if a downstream application explicitly allows `formaction` on submit-capable controls in untrusted HTML, Bleach preserves dangerous values such as `javascript:alert(1)` instead of stripping them. This can lead to **submit-triggered JavaScript execution** in applications that rely on Bleach to sanitize untrusted HTML and allow the relevant tag/attribute combination. --- ### Details The issue appears to be a URI-sanitization coverage gap in Bleach’s sanitizer logic. Relevant code paths: * `bleach/sanitizer.py` — `BleachSanitizerFilter.allow_token` (around line 553) * `bleach/_vendor/html5lib/filters/sanitizer.py` — `attr_val_is_uri` (around line 525) In `BleachSanitizerFilter.allow_token`, URI protocol sanitization is only applied when: ```python id="pft79m" if namespaced_name in self.attr_val_is_uri: ``` However, `(None, 'formaction')` is currently missing from `attr_val_is_uri`. This creates an inconsistency where `action` is protocol-sanitized, but `formaction` is not. As a result, if a downstream application allows: * tags such as `<button>` or `<input>` * the `formaction` attribute then Bleach preserves dangerous URI schemes such as `javascript:` in `formaction`. Examples of affected submit-capable controls include: * `<button>` (default submit behavior unless `type="button"` is set) * `<input type="submit">` * `<input type="image">` This appears to be a real library-side sanitizer gap rather than only an application misuse issue, because Bleach already treats similar URI-bearing attributes (such as `action`) as protocol-sensitive and sanitizes them. Suggested minimal fix: Add: ```python id="4v4fkn" (None,