Attachment 710234 Details for Bug 921335 – 3-0-sanitize_protocol.patch

[patch] 3-0-sanitize_protocol.patch

3-0-sanitize_protocol.patch (text/plain), 2.14 KB, created by Kurt Seifried on 2013-03-14 20:33:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-03-14 20:33:25 UTC

Size: 2.14 KB

patch

obsolete

>From 275286186e4c4f79b768165c203d455bc7fac467 Mon Sep 17 00:00:00 2001
>From: Aaron Patterson <aaron.patterson@gmail.com>
>Date: Wed, 13 Mar 2013 13:49:23 -0700
>Subject: [PATCH] fix protocol checking in sanitization
>
>Conflicts:
>	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>
>Conflicts:
>	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>---
> actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb | 2 +-
> actionpack/test/template/html-scanner/sanitizer_test.rb                | 2 ++
> 2 files changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>index 6cf4d27..e21959f 100644
>--- a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>+++ b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>@@ -170,7 +170,7 @@ module HTML
> 
>     def contains_bad_protocols?(attr_name, value)
>       uri_attributes.include?(attr_name) &&
>-      (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(%|&#37;)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first))
>+      (value =~ /(^[^\/:]*):|(&#0*58)|(&#x3a)|(&#x70)|(%|&#37;)3A/i && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip))
>     end
>   end
> end
>diff --git a/actionpack/test/template/html-scanner/sanitizer_test.rb b/actionpack/test/template/html-scanner/sanitizer_test.rb
>index d9853e8..fa36425 100644
>--- a/actionpack/test/template/html-scanner/sanitizer_test.rb
>+++ b/actionpack/test/template/html-scanner/sanitizer_test.rb
>@@ -168,6 +168,8 @@ class SanitizerTest < ActionController::TestCase
>    %(<IMG SRC="jav&#x0A;ascript:alert('XSS');">),
>    %(<IMG SRC="jav&#x0D;ascript:alert('XSS');">),
>    %(<IMG SRC=" &#14;  javascript:alert('XSS');">),
>+   %(<IMG SRC="javascript&#x3a;alert('XSS');">),
>+   %(<IMG SRC="javascript&#x3A;alert('XSS');">),
>    %(<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>)].each_with_index do |img_hack, i|
>     define_method "test_should_not_fall_for_xss_image_hack_#{i+1}" do
>       assert_sanitized img_hack, "<img>"
>-- 
>1.8.1.1
>

Actions: View | Diff

Attachments on bug 921335: 710233 | 710234 | 710235 | 710236 | 711753 | 711754 | 711755 | 711756