From d5802cb9fff00bab4f39405ae4fd89e73c7a5d6c Mon Sep 17 00:00:00 2001
From: mohammed arib <arib@bugqore.com>
Date: Mon, 24 Aug 2026 12:25:38 +0530
Subject: [PATCH] strip tab in attribute value to block tabbed data:text/html
 uri

---
 Tests/InputFilterTest.php | 13 +++++++++++++
 src/InputFilter.php       |  4 ++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/Tests/InputFilterTest.php b/Tests/InputFilterTest.php
index cda40c01..8ef54952 100644
--- a/Tests/InputFilterTest.php
+++ b/Tests/InputFilterTest.php
@@ -2048,4 +2048,17 @@ public function testCleanObject()
 
         $this->assertEquals($expected, $filter->clean($object));
     }
+
+    /**
+     * A tab inside the scheme must not slip a data:text/html URI past the attribute filter,
+     * as browsers strip tab/newline characters when parsing a URL.
+     */
+    public function testCleanStripsTabbedHtmlDataUri()
+    {
+        $filter = new InputFilter(['a'], ['href']);
+
+        $input = "<a href=\"data:text/\thtml;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\">Data link</a>";
+
+        $this->assertSame('<a>Data link</a>', $filter->clean($input, 'html'));
+    }
 }
diff --git a/src/InputFilter.php b/src/InputFilter.php
index ed60b0cc..d2bd33df 100644
--- a/src/InputFilter.php
+++ b/src/InputFilter.php
@@ -586,8 +586,8 @@ protected function cleanAttributes(array $attrSet)
             // Strips unicode, hex, etc
             $attrSubSet[1] = str_replace('&#', '', $attrSubSet[1]);
 
-            // Strip normal newline within attr value
-            $attrSubSet[1] = preg_replace('/[\n\r]/', '', $attrSubSet[1]);
+            // Strip tab and newline within attr value (browsers drop these when parsing a URL)
+            $attrSubSet[1] = preg_replace('/[\t\n\r]/', '', $attrSubSet[1]);
 
             // Strip double quotes
             $attrSubSet[1] = str_replace('"', '', $attrSubSet[1]);