clones/friendica
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #6177 from annando/oembed-escaping 

Sanitize the OEmbed data before processing it
This commit is contained in:
Hypolite Petovan 2018-11-21 08:06:26 -05:00 committed by GitHub
parent a76c00de66 aa1882fd99
commit a25df1a9c1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/Content/OEmbed.php
View File

@ -247,8 +247,7 @@ class OEmbed
$ret .= '</div>';
$ret = str_replace("\n", "", $ret);
return mb_convert_encoding($ret, 'HTML-ENTITIES', mb_detect_encoding($ret));
return str_replace("\n", "", $ret);
}
public static function BBCode2HTML($text)

11
src/Object/OEmbed.php
View File

@ -42,6 +42,17 @@ class OEmbed
}
foreach ($properties as $key => $value) {
if (in_array($key, ['thumbnail_width', 'thumbnail_height', 'width', 'height'])) {
// These values should be numbers, so ensure that they really are numbers.
$value = (int)$value;
} elseif ($key != 'html') {
// Avoid being able to inject some ugly stuff through these fields.
$value = htmlentities($value);
} else {
/// @todo Add a way to sanitize the html as well, possibly with an <iframe>?
$value = mb_convert_encoding($value, 'HTML-ENTITIES', mb_detect_encoding($value));
}
if (property_exists(__CLASS__, $key)) {
$this->{$key} = $value;
}