[HtmlSanitizer] Remove srcdoc from allowed attributes

The `srcdoc` attribute is unlisted from the standard attributes to prevent potential misconfiguration.
It must now be explicitly enabled, and it is STRONGLY advised to `->forceAttribute('iframe', 'sandbox', '')` when doing so.
A new test ensures that `<iframe>` elements with unsafe attributes, including `srcdoc`, are sanitized correctly.

Author: Spomky

Reference/W3CReference.php

@@ -368,7 +368,7 @@ final class W3CReference
         'span' => true,
         'spellcheck' => true,
         'src' => true,
-        'srcdoc' => true,
+        // 'srcdoc' => false, // XSS vector if not properly sandboxed, should be enabled explicitly with ->allowAttribute('srcdoc', 'iframe')->forceAttribute('iframe', 'sandbox', '')
         'srclang' => true,
         'srcset' => true,
         'standby' => true,

Tests/Fixtures/baseline-attribute-allow-list.json

@@ -182,7 +182,6 @@
   "span",
   "spellcheck",
   "src",
-  "srcdoc",
   "srclang",
   "srcset",
   "standby",

Tests/HtmlSanitizerAllTest.php

@@ -568,6 +568,23 @@ public static function provideSanitizeBody()
         }
     }
 
+    public function testIFrameDefaultsAreSafe()
+    {
+        $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())
+            ->allowElement('iframe', '*')
+        );
+        $input = '<iframe src="javascript:alert()" onload="alert()" srcdoc="<script>alert()</script>">XSS</iframe>';
+        $this->assertSame('<iframe>XSS</iframe>', $sanitizer->sanitize($input));
+
+        $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())
+            ->allowElement('iframe', '*')
+            ->allowAttribute('srcdoc', 'iframe')
+            ->forceAttribute('iframe', 'sandbox', '')
+        );
+        $input = '<iframe src="javascript:alert()" onload="alert()" srcdoc="<script>alert()</script>">XSS-prevented by sandbox</iframe>';
+        $this->assertSame('<iframe srcdoc="&lt;script&gt;alert()&lt;/script&gt;" sandbox>XSS-prevented by sandbox</iframe>', $sanitizer->sanitize($input));
+    }
+
     public function testUnlimitedLength()
     {
         $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())->withMaxInputLength(-1));

Tests/HtmlSanitizerConfigTest.php

@@ -109,7 +109,7 @@ public function testAllowElementStandardAttributes()
         $config = new HtmlSanitizerConfig();
         $config = $config->allowElement('div', '*');
         $this->assertSame(['div'], array_keys($config->getAllowedElements()));
-        $this->assertCount(211, $config->getAllowedElements()['div']);
+        $this->assertCount(210, $config->getAllowedElements()['div']);
         $this->assertSame([], $config->getBlockedElements());
     }