[FP]: rails html sanitizer confused for C# project

[chadlwilson]

Package URl

pkg:gem/rails-html-sanitizer@1.7.0

CPE

cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:1.7.0:*:*:*:*:*:*:*

CVE

No response

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.2.2

Description

“ HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks.”

[chadlwilson]

This Fp is weird, because nothing has directly changed ( on NvD side, or with Ruby depenedencies) yet suddenly these vulns are appearing.

There is likely a bug with the bundler-audit analyzer that causes this indeterminism, as it also has a false negative for https://discuss.rubyonrails.org/t/ghsa-cj75-f6xr-r4g7-possible-xss-vulnerability-with-certain-configurations-of-rails-html-sanitizer/91359 which should be reported. I suspect the new vuln is appearing in bundler-audit results (which draws the dependency t9 the attention 9 t( rest of the subsequent analyzers, including the CPE one) but is then being discarded and overwritten with an incorrect CPE match for whatever reason.

[chadlwilson]