Add rust-ammonia/ammonia#147 (#1152)

crates/ammonia/RUSTSEC-0000-0000.md

@@ -0,0 +1,25 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "ammonia"
+date = "2022-01-19"
+url = "https://github.com/rust-ammonia/ammonia/pull/147"
+categories = ["format-injection"]
+keywords = ["html", "xss"]
+
+[affected]
+functions = { "ammonia::clean_text" = ["<= 3.1.2"] }
+
+[versions]
+patched = [">= 3.1.3"]
+unaffected = ["< 3.0.0"]
+```
+
+# Space bug in `clean_text`
+
+An incorrect mapping from HTML specification to ASCII codes was used.
+Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
+
+    let html = format!("<div title={}>", clean_text(user_supplied_string));
+
+Applications are not affected if they quote their attributes, or if they don't use `clean_text` at all.