clones/friendica
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

src and href attributes sanitization touchups 

- Use Config::get
- Add default to config call
- Add always allowed protocol to href
- Remove relative root URLs from allowed forms
This commit is contained in:
Hypolite Petovan 2016-12-04 21:33:29 -05:00
parent 5e20aed428
commit 2b75ad5e0a
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
include/bbcode.php
View File

@ -1,4 +1,6 @@
<?php <?php
use \Friendica\Core\Config;
require_once("include/oembed.php"); require_once("include/oembed.php");
require_once('include/event.php'); require_once('include/event.php');
require_once('include/map.php'); require_once('include/map.php');
@ -1163,12 +1165,16 @@ function bbcode($Text,$preserve_nl = false, $tryoembed = true, $simplehtml = fal
// fix any escaped ampersands that may have been converted into links // fix any escaped ampersands that may have been converted into links
$Text = preg_replace('/\<([^>]*?)(src|href)=(.*?)\&amp\;(.*?)\>/ism', '<$1$2=$3&$4>', $Text); $Text = preg_replace('/\<([^>]*?)(src|href)=(.*?)\&amp\;(.*?)\>/ism', '<$1$2=$3&$4>', $Text);
// sanitizes src attributes (only relative URIs or http URLs) // sanitizes src attributes (only relative redir URIs or http URLs)
$Text = preg_replace('#<([^>]*?)(src)="(?!/|http)(.*?)"(.*?)>#ism', '<$1$2=""$4 class="invalid-src" title="' . t('Invalid source protocol') . '">', $Text); $Text = preg_replace('#<([^>]*?)(src)="(?!http|redir)(.*?)"(.*?)>#ism', '<$1$2=""$4 class="invalid-src" title="' . t('Invalid source protocol') . '">', $Text);
// sanitize href attributes (only relative URIs or whitelisted protocols URLs) // sanitize href attributes (only whitelisted protocols URLs)
$allowed_link_protocols = get_config('system', 'allowed_link_protocols'); $allowed_link_protocols = Config::get('system', 'allowed_link_protocols', array());
$regex = '#<([^>]*?)(href)="(?!/|http|' . implode('|', $allowed_link_protocols) . ')(.*?)"(.*?)>#ism';
// Always allowed protocol even if config isn't set
$allowed_link_protocols[] = 'http';
$regex = '#<([^>]*?)(href)="(?!' . implode('|', $allowed_link_protocols) . ')(.*?)"(.*?)>#ism';
$Text = preg_replace($regex, '<$1$2="javascript:void(0)"$4 class="invalid-href" title="' . t('Invalid link protocol') . '">', $Text); $Text = preg_replace($regex, '<$1$2="javascript:void(0)"$4 class="invalid-href" title="' . t('Invalid link protocol') . '">', $Text);
if($saved_image) { if($saved_image) {