Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SECURITY: Fix animate blacklist

Browse source 
The blacklist should prevent animating any element's xlink:href to a
javascript url.

Bug: T86711
Change-Id: Ia9e9192165fdfe1701f22605eee0b0e5c9137d5a
This commit is contained in:
csteipp 2015-01-13 16:48:01 -08:00
parent bf5f708dc5
commit b5f491fb6d
2 changed files with 15 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
includes/upload/UploadBase.php
View file

@ -1424,11 +1424,10 @@ abstract class UploadBase {
}
}
# Change href with animate from (http://html5sec.org/#137). This doesn't seem
# possible without embedding the svg, but filter here in case.
if ( $stripped == 'from'
# Change href with animate from (http://html5sec.org/#137).
if ( $stripped === 'attributename'
&& $strippedElement === 'animate'
&& !preg_match( '!^https?://!im', $value )
&& $this->stripXmlNamespace( $value ) == 'href'
) {
wfDebug( __METHOD__ . ": Found animate that might be changing href using from "
. "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );

12
tests/phpunit/includes/upload/UploadBaseTest.php
View file

@ -279,6 +279,18 @@ class UploadBaseTest extends MediaWikiTestCase {
true,
'SVG with animate from (http://html5sec.org/#137)'
),
array(
'<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <a><text y="1em">Click me</text> <animate attributeName="xlink:href" values="javascript:alert(\'Bang!\')" begin="0s" dur="0.1s" fill="freeze" /> </a></svg>',
true,
true,
'SVG with animate xlink:href (http://html5sec.org/#137)'
),
array(
'<svg xmlns="http://www.w3.org/2000/svg" xmlns:y="http://www.w3.org/1999/xlink"> <a y:href="#"> <text y="1em">Click me</text> <animate attributeName="y:href" values="javascript:alert(\'Bang!\')" begin="0s" dur="0.1s" fill="freeze" /> </a> </svg>',
true,
true,
'SVG with animate y:href (http://html5sec.org/#137)'
),
// Other hostile SVG's
array(