From bf128a5df6ad7ec75e40dee8c465432d7b401bf9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartosz=20Dziewo=C5=84ski?= Date: Tue, 1 Dec 2015 22:28:05 +0100 Subject: [PATCH] Strip markers that don't pass through htmlspecialchars() Change-Id: Ibf93b55ed883ffa5710606ff1ad45bf003fd65da --- includes/Sanitizer.php | 7 +++++++ includes/parser/Parser.php | 6 ++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php index 4fc3209..ff7b7ec 100644 --- a/includes/Sanitizer.php +++ b/includes/Sanitizer.php @@ -618,6 +618,13 @@ class Sanitizer { $text .= '<' . str_replace( '>', '>', $x ); } } + + // TODO Is this itself unsafe? Can this cause XSS? I think not, since we disallow \x7f in input earlier? + $text = strtr( $text, array( + htmlspecialchars( Parser::MARKER_SUFFIX ) => Parser::MARKER_SUFFIX, + htmlspecialchars( Parser::MARKER_PREFIX ) => Parser::MARKER_PREFIX, + ) ); + return $text; } diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php index cfbf0b4..9aa04d7 100644 --- a/includes/parser/Parser.php +++ b/includes/parser/Parser.php @@ -132,8 +132,8 @@ class Parser { * Must not consist of all title characters, or else it will change * the behavior of in a link. */ - const MARKER_SUFFIX = "-QINU\x7f"; - const MARKER_PREFIX = "\x7fUNIQ-"; + const MARKER_SUFFIX = ">-QINU\x7f"; + const MARKER_PREFIX = "\x7fUNIQ-<"; # Markers used for wrapping the table of contents const TOC_START = ''; @@ -1245,12 +1245,14 @@ class Parser { } Hooks::run( 'InternalParseBeforeSanitize', array( &$this, &$text, &$this->mStripState ) ); + // var_dump($text); $text = Sanitizer::removeHTMLtags( $text, array( &$this, 'attributeStripCallback' ), false, array_keys( $this->mTransparentTagHooks ) ); + // var_dump($text); Hooks::run( 'InternalParseBeforeLinks', array( &$this, &$text, &$this->mStripState ) ); # Tables need to come after variable replacement for things to work -- 1.9.5.msysgit.0