Better sanitization of attributes that contain 'data:'.
Patch by afuna.
diffs (24 lines):
diff -r 26da4077388b -r c907acdb61fd cgi-bin/LJ/CleanHTML.pm
--- a/cgi-bin/LJ/CleanHTML.pm Fri Oct 16 04:55:42 2009 +0000
+++ b/cgi-bin/LJ/CleanHTML.pm Fri Oct 16 04:58:28 2009 +0000
@@ -565,11 +565,6 @@ sub clean
next;
}
- if ($attr eq "href" && $hash->{$attr} =~ /^data/) {
- delete $hash->{$attr};
- next;
- }
-
if ($attr =~ /(?:^=)|[\x0b\x0d]/) {
# Cleaner attack: <p ='>'
onmouseover="javascript:alert(document/**/.cookie)" >
# is returned by HTML::Parser as P_tag("='" => "='")
Text( onmouseover...)
@@ -593,7 +588,7 @@ sub clean
# IE sucks:
my $nowhite = $hash->{$attr};
$nowhite =~ s/[\s\x0b]+//g;
- if ($nowhite =~
/(?:jscript|livescript|javascript|vbscript|about):/ix) {
+ if ($nowhite =~
/(?:jscript|livescript|javascript|vbscript|about|data):/ix) {
delete $hash->{$attr};
next;
}
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
