SECURITY: blacklist CSS var()

Bug: T208881
Change-Id: I9a4ced2bc47eb5f96cf35e693bf5261c48acb126

diff --git a/includes/parser/Sanitizer.php b/includes/parser/Sanitizer.php
index abf0714..f76e3a9 100644 (file)
--- a/includes/parser/Sanitizer.php
+++ b/includes/parser/Sanitizer.php
@@ -1073,6 +1073,7 @@ class Sanitizer {
                                | image\s*\(
                                | image-set\s*\(
                                | attr\s*\([^)]+[\s,]+url
+                               | var\s*\(
                        !ix', $value ) ) {
                        return '/* insecure input */';
                }

diff --git a/tests/phpunit/includes/parser/SanitizerTest.php b/tests/phpunit/includes/parser/SanitizerTest.php
index 1f6f4e8..1b67bbd 100644 (file)
--- a/tests/phpunit/includes/parser/SanitizerTest.php
+++ b/tests/phpunit/includes/parser/SanitizerTest.php
@@ -326,6 +326,7 @@ class SanitizerTest extends MediaWikiTestCase {
                        ],
                        [ '/* insecure input */', 'foo: attr( title, url );' ],
                        [ '/* insecure input */', 'foo: attr( title url );' ],
+                       [ '/* insecure input */', 'foo: var(--evil-attribute)' ],
                ];
        }