SECURITY: blacklist CSS var()

[lhc/web/wiklou.git] / includes / parser / Sanitizer.php

diff --git a/includes/parser/Sanitizer.php b/includes/parser/Sanitizer.php
index 35a5944..f76e3a9 100644 (file)
--- a/includes/parser/Sanitizer.php
+++ b/includes/parser/Sanitizer.php
@@ -1073,6 +1073,7 @@ class Sanitizer {
                                | image\s*\(
                                | image-set\s*\(
                                | attr\s*\([^)]+[\s,]+url
+                               | var\s*\(
                        !ix', $value ) ) {
                        return '/* insecure input */';
                }
@@ -1957,6 +1958,7 @@ class Sanitizer {
 
                        // HTML 5 section 4.5
                        'figure'     => $common,
+                       'figure-inline' => $common, # T118520
                        'figcaption' => $common,
 
                        # HTML 5 section 4.6