From 9f301fcfa635675bae169589f8bb7fb121f217f8 Mon Sep 17 00:00:00 2001 From: Max Semenik Date: Tue, 6 Nov 2018 18:38:22 -0800 Subject: [PATCH] SECURITY: blacklist CSS var() Bug: T208881 Change-Id: I9a4ced2bc47eb5f96cf35e693bf5261c48acb126 --- includes/parser/Sanitizer.php | 1 + tests/phpunit/includes/parser/SanitizerTest.php | 1 + 2 files changed, 2 insertions(+) diff --git a/includes/parser/Sanitizer.php b/includes/parser/Sanitizer.php index 85c71ee..374fd37 100644 --- a/includes/parser/Sanitizer.php +++ b/includes/parser/Sanitizer.php @@ -1056,6 +1056,7 @@ class Sanitizer { | image\s*\( | image-set\s*\( | attr\s*\([^)]+[\s,]+url + | var\s*\( !ix', $value ) ) { return '/* insecure input */'; } diff --git a/tests/phpunit/includes/parser/SanitizerTest.php b/tests/phpunit/includes/parser/SanitizerTest.php index a8b0f90..fe48093 100644 --- a/tests/phpunit/includes/parser/SanitizerTest.php +++ b/tests/phpunit/includes/parser/SanitizerTest.php @@ -322,6 +322,7 @@ class SanitizerTest extends MediaWikiTestCase { ], [ '/* insecure input */', 'foo: attr( title, url );' ], [ '/* insecure input */', 'foo: attr( title url );' ], + [ '/* insecure input */', 'foo: var(--evil-attribute)' ], ]; } -- 2.8.1