Incorrect handling of embedded SVG and MathML leads to mutation XSS

Summary

The MathML text integration points (`mi`, `mo`, `mn`, `ms`, `mtext`) and SVG `foreignObject` can be made to contain a tag in the other one's namespace (a MathML integration point with a child in the SVG namespace, or vice versa) without the root tag that switches out of the HTML namespace. If the attacker can construct input that parses differently in as HTML than as foreign XML, they can inject arbitrary JavaScript code into the user's browser.

For example:

- The user writes `<math><mi><svg><gadget></svg></mi></math>`. - The application enables `math`, `mi`, and the gadget, but not `svg`. - Ammonia filters the input to `<math><mi><gadget></mi></math>`. - Because svg is now gone, the gadget switches from being parsed as SVG to being parsed as HTML. - The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

As far as we know, the gadget can only be written using a tag that is parsed as raw text in HTML. These [elements] are:

- title - textarea - xmp - iframe - noembed - noframes - plaintext - noscript - style - script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

[elements]: https://github.com/servo/html5ever/blob/a027c2835472d518893c906dc29c42200af3c960/html5ever/src/tree_builder/rules.rs

---

This vulnerability was reported by Roger Meyer.