From 770c8cadd488c24a7cefc61a57e0d328e3174643 Mon Sep 17 00:00:00 2001
From: Michael Howell <michael@notriddle.com>
Date: Wed, 19 Jan 2022 15:33:28 -0700
Subject: [PATCH] Add rust-ammonia/ammonia#147 (#1152)

---
 crates/ammonia/RUSTSEC-0000-0000.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 crates/ammonia/RUSTSEC-0000-0000.md

diff --git a/crates/ammonia/RUSTSEC-0000-0000.md b/crates/ammonia/RUSTSEC-0000-0000.md
new file mode 100644
index 0000000..f2a929e
--- /dev/null
+++ b/crates/ammonia/RUSTSEC-0000-0000.md
@@ -0,0 +1,25 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "ammonia"
+date = "2022-01-19"
+url = "https://github.com/rust-ammonia/ammonia/pull/147"
+categories = ["format-injection"]
+keywords = ["html", "xss"]
+
+[affected]
+functions = { "ammonia::clean_text" = ["<= 3.1.2"] }
+
+[versions]
+patched = [">= 3.1.3"]
+unaffected = ["< 3.0.0"]
+```
+
+# Space bug in `clean_text`
+
+An incorrect mapping from HTML specification to ASCII codes was used.
+Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
+
+    let html = format!("<div title={}>", clean_text(user_supplied_string));
+
+Applications are not affected if they quote their attributes, or if they don't use `clean_text` at all.