Attachment 711754 Details for Bug 921335 – 3-0-sanitize_protocol.patch

[patch] 3-0-sanitize_protocol.patch

3-0-sanitize_protocol.patch (text/plain), 3.19 KB, created by Kurt Seifried on 2013-03-18 05:32:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-03-18 05:32:28 UTC

Size: 3.19 KB

patch

obsolete

>From 77403a9b04073713e2b758c22174a81bb3cd62b9 Mon Sep 17 00:00:00 2001
>From: Aaron Patterson <aaron.patterson@gmail.com>
>Date: Fri, 15 Mar 2013 15:04:00 -0700
>Subject: [PATCH] fix protocol checking in sanitization [CVE-2013-1857]
>
>Conflicts:
>	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>---
> .../action_controller/vendor/html-scanner/html/sanitizer.rb    |  4 ++--
> actionpack/test/template/html-scanner/sanitizer_test.rb        | 10 ++++++++++
> 2 files changed, 12 insertions(+), 2 deletions(-)
>
>diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>index 6cf4d27..b4c0b0f 100644
>--- a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>+++ b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
>@@ -65,7 +65,7 @@ module HTML
> 
>     # A regular expression of the valid characters used to separate protocols like
>     # the ':' in 'http://foo.com'
>-    self.protocol_separator     = /:|(&#0*58)|(&#x70)|(%|&#37;)3A/
>+    self.protocol_separator     = /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|&#37;)3A/i
> 
>     # Specifies a Set of HTML attributes that can have URIs.
>     self.uri_attributes         = Set.new(%w(href src cite action longdesc xlink:href lowsrc))
>@@ -170,7 +170,7 @@ module HTML
> 
>     def contains_bad_protocols?(attr_name, value)
>       uri_attributes.include?(attr_name) &&
>-      (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(%|&#37;)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first))
>+      (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(&#x0*3a)|(%|&#37;)3A/i && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip))
>     end
>   end
> end
>diff --git a/actionpack/test/template/html-scanner/sanitizer_test.rb b/actionpack/test/template/html-scanner/sanitizer_test.rb
>index d9853e8..aa0be26 100644
>--- a/actionpack/test/template/html-scanner/sanitizer_test.rb
>+++ b/actionpack/test/template/html-scanner/sanitizer_test.rb
>@@ -168,6 +168,7 @@ class SanitizerTest < ActionController::TestCase
>    %(<IMG SRC="jav&#x0A;ascript:alert('XSS');">),
>    %(<IMG SRC="jav&#x0D;ascript:alert('XSS');">),
>    %(<IMG SRC=" &#14;  javascript:alert('XSS');">),
>+   %(<IMG SRC="javascript&#x3a;alert('XSS');">),
>    %(<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>)].each_with_index do |img_hack, i|
>     define_method "test_should_not_fall_for_xss_image_hack_#{i+1}" do
>       assert_sanitized img_hack, "<img>"
>@@ -273,6 +274,15 @@ class SanitizerTest < ActionController::TestCase
>     assert_sanitized "<span class=\"\\", "<span class=\"\\\">"
>   end
> 
>+  def test_x03a
>+    assert_sanitized %(<a href="javascript&#x3a;alert('XSS');">), "<a>"
>+    assert_sanitized %(<a href="javascript&#x003a;alert('XSS');">), "<a>"
>+    assert_sanitized %(<a href="http&#x3a;//legit">), %(<a href="http://legit">)
>+    assert_sanitized %(<a href="javascript&#x3A;alert('XSS');">), "<a>"
>+    assert_sanitized %(<a href="javascript&#x003A;alert('XSS');">), "<a>"
>+    assert_sanitized %(<a href="http&#x3A;//legit">), %(<a href="http://legit">)
>+  end
>+
> protected
>   def assert_sanitized(input, expected = nil)
>     @sanitizer ||= HTML::WhiteListSanitizer.new
>-- 
>1.8.1.1
>

Actions: View | Diff

Attachments on bug 921335: 710233 | 710234 | 710235 | 710236 | 711753 | 711754 | 711755 | 711756