kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]

Browse source
This commit is contained in:
Charlie Somerville 2013-02-13 09:09:53 +11:00 committed by Aaron Patterson
parent 5dc2e3531b
commit 8be6913990
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
actionpack/lib/action_view/vendor/html-scanner/html/sanitizer.rb vendored
View file

@ -121,8 +121,8 @@ module HTML
style = style.to_s.gsub(/url\s*\(\s*[^\s)]+?\s*\)\s*/, ' ') style = style.to_s.gsub(/url\s*\(\s*[^\s)]+?\s*\)\s*/, ' ')
# gauntlet # gauntlet
if style !~ /^([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*$/ || if style !~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*\z/ ||
style !~ /^(\s*[-\w]+\s*:\s*[^:;]*(;|$)\s*)*$/ style !~ /\A(\s*[-\w]+\s*:\s*[^:;]*(;|$)\s*)*\z/
return '' return ''
end end
@ -133,7 +133,7 @@ module HTML
elsif shorthand_css_properties.include?(prop.split('-')[0].downcase) elsif shorthand_css_properties.include?(prop.split('-')[0].downcase)
unless val.split().any? do |keyword| unless val.split().any? do |keyword|
!allowed_css_keywords.include?(keyword) && !allowed_css_keywords.include?(keyword) &&
keyword !~ /^(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)$/ keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/
end end
clean << prop + ': ' + val + ';' clean << prop + ': ' + val + ';'
end end

5
actionpack/test/template/html-scanner/sanitizer_test.rb
View file

@ -279,6 +279,11 @@ class SanitizerTest < ActionController::TestCase
assert_equal '', sanitize_css(raw) assert_equal '', sanitize_css(raw)
end end
def test_should_sanitize_across_newlines
raw = %(\nwidth:\nexpression(alert('XSS'));\n)
assert_equal '', sanitize_css(raw)
end
def test_should_sanitize_img_vbscript def test_should_sanitize_img_vbscript
assert_sanitized %(<img src='vbscript:msgbox("XSS")' />), '<img />' assert_sanitized %(<img src='vbscript:msgbox("XSS")' />), '<img />'
end end