Merge "phpunit: Avoid use of deprecated getMock for PHPUnit 5 compat"

[lhc/web/wiklou.git] / includes / upload / UploadBase.php

diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php
index 733c4ff..2c0afdf 100644 (file)
--- a/includes/upload/UploadBase.php
+++ b/includes/upload/UploadBase.php
@@ -1359,7 +1359,10 @@ abstract class UploadBase {
                        $filename,
                        [ $this, 'checkSvgScriptCallback' ],
                        true,
-                       [ 'processing_instruction_handler' => 'UploadBase::checkSvgPICallback' ]
+                       [
+                               'processing_instruction_handler' => 'UploadBase::checkSvgPICallback',
+                               'external_dtd_handler' => 'UploadBase::checkSvgExternalDTD',
+                       ]
                );
                if ( $check->wellFormed !== true ) {
                        // Invalid xml (T60553)
@@ -1391,6 +1394,34 @@ abstract class UploadBase {
                return false;
        }
 
+       /**
+        * Verify that DTD urls referenced are only the standard dtds
+        *
+        * Browsers seem to ignore external dtds. However just to be on the
+        * safe side, only allow dtds from the svg standard.
+        *
+        * @param string $type PUBLIC or SYSTEM
+        * @param string $publicId The well-known public identifier for the dtd
+        * @param string $systemId The url for the external dtd
+        */
+       public static function checkSvgExternalDTD( $type, $publicId, $systemId ) {
+               // This doesn't include the XHTML+MathML+SVG doctype since we don't
+               // allow XHTML anyways.
+               $allowedDTDs = [
+                       'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd',
+                       'http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd',
+                       'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd',
+                       'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd'
+               ];
+               if ( $type !== 'PUBLIC'
+                       || !in_array( $systemId, $allowedDTDs )
+                       || strpos( $publicId, "-//W3C//" ) !== 0
+               ) {
+                       return [ 'upload-scripted-dtd' ];
+               }
+               return false;
+       }
+
        /**
         * @todo Replace this with a whitelist filter!
         * @param string $element