webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-09-10 17:31:58 +03:00
Code Activity

Added filter for xlink:href svg xss

Browse Source 
Simply remove all such attributes
This commit is contained in:
Dan Brown
2021-09-03 22:34:49 +01:00
parent 5e6092aaf8
commit 040997fdc4
2 changed files with 42 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
app/Util/HtmlContentFilter.php
View File

@@ -2,6 +2,7 @@
namespace BookStack\Util;
use DOMAttr;
use DOMDocument;
use DOMNodeList;
use DOMXPath;
@@ -43,13 +44,14 @@ class HtmlContentFilter
$badIframes = $xPath->query('//*[' . static::xpathContains('@src', 'data:') . '] | //*[' . static::xpathContains('@src', 'javascript:') . '] | //*[@srcdoc]');
static::removeNodes($badIframes);
// Remove elements with a xlink:href attribute
// Used in SVG but deprecated anyway, so we'll be a bit more heavy-handed here.
$xlinkHrefAttributes = $xPath->query('//@*[contains(name(), \'xlink:href\')]');
static::removeAttributes($xlinkHrefAttributes);
// Remove 'on*' attributes
$onAttributes = $xPath->query('//@*[starts-with(name(), \'on\')]');
foreach ($onAttributes as $attr) {
/** @var \DOMAttr $attr */
$attrName = $attr->nodeName;
$attr->parentNode->removeAttribute($attrName);
}
static::removeAttributes($onAttributes);
$html = '';
$topElems = $doc->documentElement->childNodes->item(0)->childNodes;
@@ -72,7 +74,7 @@ class HtmlContentFilter
}
/**
* Removed all of the given DOMNodes.
* Remove all the given DOMNodes.
*/
protected static function removeNodes(DOMNodeList $nodes): void
{
@@ -80,4 +82,16 @@ class HtmlContentFilter
$node->parentNode->removeChild($node);
}
}
/**
* Remove all the given attribute nodes.
*/
protected static function removeAttributes(DOMNodeList $attrs): void
{
/** @var DOMAttr $attr */
foreach ($attrs as $attr) {
$attrName = $attr->nodeName;
$attr->parentNode->removeAttribute($attrName);
}
}
}