HTMLPurifier, a standards-compliant HTML filter library written in PHP, was found to have a vulnerability, which allows the attacker to carry out a "Hash Length Extension" attack.

Class HTMLPurifier_URIFilter_Munge implements a URI filter that replaces all links with a formatted URL. To prevent links from being altered HTMLPurifier allows specifying a secret key via "URI.MungeSecretKey" configuration directive. However, this signature generation method is susceptible to a hash length extension attack.

This vulnerability allows attackers to append an arbitrary value to the signed data without knowing the secret key. This may cause other vulnerabilities in the web applications, which use signature generated by HTMLPurifier to keep the links from being altered.

References:
http://seclists.org/bugtraq/2013/Dec/16
http://www.securityfocus.com/archive/1/530142
http://en.securitylab.ru/lab/PT-2013-63