From 214b37ff07f3fde89430297b2a857750a56ae205 Mon Sep 17 00:00:00 2001 From: Max Semenik Date: Tue, 6 Nov 2018 18:38:22 -0800 Subject: [PATCH] SECURITY: blacklist CSS var() Bug: T208881 Change-Id: I9a4ced2bc47eb5f96cf35e693bf5261c48acb126 --- includes/parser/Sanitizer.php | 1 + tests/phpunit/includes/parser/SanitizerTest.php | 1 + 2 files changed, 2 insertions(+) diff --git a/includes/parser/Sanitizer.php b/includes/parser/Sanitizer.php index abf071414b..f76e3a9c5d 100644 --- a/includes/parser/Sanitizer.php +++ b/includes/parser/Sanitizer.php @@ -1073,6 +1073,7 @@ class Sanitizer { | image\s*\( | image-set\s*\( | attr\s*\([^)]+[\s,]+url + | var\s*\( !ix', $value ) ) { return '/* insecure input */'; } diff --git a/tests/phpunit/includes/parser/SanitizerTest.php b/tests/phpunit/includes/parser/SanitizerTest.php index 1f6f4e873b..1b67bbdf79 100644 --- a/tests/phpunit/includes/parser/SanitizerTest.php +++ b/tests/phpunit/includes/parser/SanitizerTest.php @@ -326,6 +326,7 @@ class SanitizerTest extends MediaWikiTestCase { ], [ '/* insecure input */', 'foo: attr( title, url );' ], [ '/* insecure input */', 'foo: attr( title url );' ], + [ '/* insecure input */', 'foo: var(--evil-attribute)' ], ]; } -- 2.20.1