diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php index 8c3f1740a20..6da8250b7ed 100644 --- a/includes/upload/UploadBase.php +++ b/includes/upload/UploadBase.php @@ -1424,11 +1424,10 @@ abstract class UploadBase { } } - # Change href with animate from (http://html5sec.org/#137). This doesn't seem - # possible without embedding the svg, but filter here in case. - if ( $stripped == 'from' + # Change href with animate from (http://html5sec.org/#137). + if ( $stripped === 'attributename' && $strippedElement === 'animate' - && !preg_match( '!^https?://!im', $value ) + && $this->stripXmlNamespace( $value ) == 'href' ) { wfDebug( __METHOD__ . ": Found animate that might be changing href using from " . "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" ); diff --git a/tests/phpunit/includes/upload/UploadBaseTest.php b/tests/phpunit/includes/upload/UploadBaseTest.php index 8c5c9236a99..c027af6bd49 100644 --- a/tests/phpunit/includes/upload/UploadBaseTest.php +++ b/tests/phpunit/includes/upload/UploadBaseTest.php @@ -279,6 +279,18 @@ class UploadBaseTest extends MediaWikiTestCase { true, 'SVG with animate from (http://html5sec.org/#137)' ), + array( + ' Click me ', + true, + true, + 'SVG with animate xlink:href (http://html5sec.org/#137)' + ), + array( + ' Click me ', + true, + true, + 'SVG with animate y:href (http://html5sec.org/#137)' + ), // Other hostile SVG's array(