## Summary
Gogs contains a stored cross-site scripting (XSS) vulnerability in the comment and issue description functionality prior to 0.14.2. The HTML sanitizer allows data: URI schemes, enabling authenticated users to inject JavaScript execution via malicious links.
## Technical Details
- Root cause is in internal/markup/sanitizer.go, where NewSanitizer() configures the bluemonday sanitizer to allow data URL schemes via sanitizer.policy.AllowURLSchemes("data").
- Gogs supports raw HTML input; raw HTML anchor tags bypass Markdown link rewriting, so href="data:text/html..." payloads are processed directly by the sanitizer.
- The fix restricts data: URI handling to safe image MIME types (e.g., png/jpeg/gif/webp/x-icon) and strips data:text/html and other unsafe cases (including SVG with embedded JavaScript).
- The repository test update (Test_Sanitizer) explicitly asserts that data:text/html;base64,... links are stripped to plain text (e.g., expected output Click), and that data:text/html,<script>... is removed.
## Affected
- gogs versions: < 0.14.2
## Impact
- Stored XSS in comments and issue descriptions.
- Authenticated users can inject JavaScript that executes when victims view the content and click the malicious link.
- Potential outcomes include stealing authentication cookies/session tokens, performing actions as the victim, and redirecting users.
## Mitigation
1. Upgrade Gogs to 0.14.2 or later (patch for GHSA-xrcr-gmf5-2r8j).
2. If immediate upgrade is not possible, review and remove any existing malicious content in comments/issue descriptions that may contain data:text/html links.
3. Validate sanitizer behavior by ensuring data: URIs are restricted to safe image MIME types and that data:text/html/SVG-based script payloads are stripped.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CWE-79