From f7d5a6753e6287be5c8b0889f01018803e27cc0a Mon Sep 17 00:00:00 2001
From: mohammed arib <arib@bugqore.com>
Date: Wed, 19 Aug 2026 16:51:22 +0530
Subject: [PATCH] block &newline; entity in attribute filter to stop
 javascript: bypass

---
 Tests/InputFilterTest.php | 30 ++++++++++++++++++++++++++++++
 src/InputFilter.php       |  1 +
 2 files changed, 31 insertions(+)

diff --git a/Tests/InputFilterTest.php b/Tests/InputFilterTest.php
index 369bb6b5..4b8298ed 100644
--- a/Tests/InputFilterTest.php
+++ b/Tests/InputFilterTest.php
@@ -687,6 +687,12 @@ public function casesGeneric()
                 '<img />',
                 'From generic cases',
             ],
+            'Kill script with newline entity' => [
+                '',
+                '<img src="java&NewLine;script:alert();" />',
+                '<img />',
+                'From generic cases',
+            ],
             'Nested tags' => [
                 '',
                 '<em><strong>Fred</strong></em>',
@@ -827,6 +833,12 @@ public function allowed()
                 '',
                 'From specific cases',
             ],
+            'Kill script with newline entity' => [
+                '',
+                '<img src="java&NewLine;script:alert();" />',
+                '',
+                'From specific cases',
+            ],
             'Nested tags' => [
                 '',
                 '<em><strong>Fred</strong></em>',
@@ -1005,6 +1017,12 @@ public function allowImg()
                 '<img />',
                 'From generic cases',
             ],
+            'Kill script with newline entity' => [
+                '',
+                '<img src="java&NewLine;script:alert();" />',
+                '<img />',
+                'From generic cases',
+            ],
             'Nested tags' => [
                 '',
                 '<em><strong>Fred</strong></em>',
@@ -1206,6 +1224,12 @@ public function allowClass()
                 '',
                 'From specific cases',
             ],
+            'Kill script with newline entity' => [
+                '',
+                '<img src="java&NewLine;script:alert();" />',
+                '',
+                'From specific cases',
+            ],
             'Nested tags' => [
                 '',
                 '<em><strong>Fred</strong></em>',
@@ -1742,6 +1766,12 @@ public function blockedImg()
                 '',
                 'From specific cases',
             ],
+            'Kill script with newline entity' => [
+                '',
+                '<img src="java&NewLine;script:alert();" />',
+                '',
+                'From specific cases',
+            ],
             'Unquoted Attribute Without Space' => [
                 '',
                 '<img height=300>',
diff --git a/src/InputFilter.php b/src/InputFilter.php
index fb2abc24..d643401b 100644
--- a/src/InputFilter.php
+++ b/src/InputFilter.php
@@ -148,6 +148,7 @@ class InputFilter
      */
     private $blockedChars = [
         '&tab;',
+        '&newline;',
         '&space;',
         '&colon;',
         '&column;',