diff options
author | Pierre Schmitz <pierre@archlinux.de> | 2010-03-09 07:35:26 +0100 |
---|---|---|
committer | Pierre Schmitz <pierre@archlinux.de> | 2010-03-09 07:35:26 +0100 |
commit | 68d8f40ee713b12fefce5dfb93f6843717ccc951 (patch) | |
tree | 2e2dd99da303081975560021fde9880efee64ee3 /includes/Sanitizer.php | |
parent | 41f758f4ba17efde372e3cd18eee6f45519b41e2 (diff) | |
parent | 6f5403ca6e8561c3dcd19284f86b4c3c8dd715ff (diff) |
Merge branch 'master' into redesign
Diffstat (limited to 'includes/Sanitizer.php')
-rw-r--r-- | includes/Sanitizer.php | 50 |
1 files changed, 37 insertions, 13 deletions
diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php index 5d58b036..0b70e002 100644 --- a/includes/Sanitizer.php +++ b/includes/Sanitizer.php @@ -658,24 +658,48 @@ class Sanitizer { * @return mixed */ static function checkCss( $value ) { - $stripped = Sanitizer::decodeCharReferences( $value ); + $value = Sanitizer::decodeCharReferences( $value ); // Remove any comments; IE gets token splitting wrong - $stripped = StringUtils::delimiterReplace( '/*', '*/', ' ', $stripped ); - - $value = $stripped; - - // ... and continue checks - $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e', - 'codepointToUtf8(hexdec("$1"))', $stripped ); - $stripped = str_replace( '\\', '', $stripped ); - if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is', - $stripped ) ) { - # haxx0r + $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value ); + + // Decode escape sequences and line continuation + // See the grammar in the CSS 2 spec, appendix D, Mozilla implements it accurately. + // IE 8 doesn't implement it at all, but there's no way to introduce url() into + // IE that doesn't hit Mozilla also. + static $decodeRegex; + if ( !$decodeRegex ) { + $space = '[\\x20\\t\\r\\n\\f]'; + $nl = '(?:\\n|\\r\\n|\\r|\\f)'; + $backslash = '\\\\'; + $decodeRegex = "/ $backslash + (?: + ($nl) | # 1. Line continuation + ([0-9A-Fa-f]{1,6})$space? | # 2. character number + (.) # 3. backslash cancelling special meaning + )/xu"; + } + $decoded = preg_replace_callback( $decodeRegex, + array( __CLASS__, 'cssDecodeCallback' ), $value ); + if ( preg_match( '!expression|https?://|url\s*\(!i', $decoded ) ) { + // Not allowed return false; + } else { + // Allowed, return CSS with comments stripped + return $value; } + } - return $value; + static function cssDecodeCallback( $matches ) { + if ( $matches[1] !== '' ) { + return ''; + } elseif ( $matches[2] !== '' ) { + return codepointToUtf8( hexdec( $matches[2] ) ); + } elseif ( $matches[3] !== '' ) { + return $matches[3]; + } else { + throw new MWException( __METHOD__.': invalid match' ); + } } /** |