Changeset 981

Show
Ignore:
Timestamp:
12/21/06 21:57:21 (2 years ago)
Author:
bchoate
Message:

Applying sanitization updates from wheeljack. BugId: 43547

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/mt3.34/lib/MT/App/Comments.pm

    r978 r981  
    170170        $ipban->ip($user_ip); 
    171171        $ipban->save(); 
    172         $ipban->commit(); 
    173172        $app->log({ 
    174173            message => $app->translate("IP [_1] banned because comment rate exceeded 8 comments in [_2] seconds.", $user_ip, 10 * $throttle_period ), 
    …… 
    528527    #$comment->visible(0); # leave as undefined 
    529528    $comment->is_junk(0); 
     529 
     530    # strip of any null characters (done after junk checks so they can 
     531    # monitor for that kind of activity) 
     532    for my $field (qw(author email url text)) { 
     533        my $val = $comment->column($field); 
     534        if ($val =~ m/\x00/) { 
     535            $val =~ tr/\x00//d; 
     536            $comment->column($field, $val); 
     537        } 
     538    } 
    530539     
    531540    return ($comment, $commenter); 
    …… 
    11361145are documented here. 
    11371146 
     1147=head1 METHODS 
     1148 
     1149=head2 $app->init 
     1150 
     1151Initializes the application and defines the serviceable modes. 
     1152 
     1153=head2 $app->init_request 
     1154 
     1155Initializes the application to service the request. 
     1156 
     1157=head2 $app->do_preview($cgi[, $err]) 
     1158 
     1159Handles the comment preview request and displays the preview using 
     1160the Comment Preview blog template. If C<$err> is specified, the 
     1161error message is relayed to the user using the Comment Error blog 
     1162template. 
     1163 
     1164=head2 $app->blog 
     1165 
     1166Returns the L<MT::Blog> object related to the entry being commented on. 
     1167 
     1168=head2 $app->eval_comment 
     1169 
     1170Evaluates the comment being posted in a variety of ways and an L<MT::Comment> 
     1171object is returned. If the comment request is rejected due to throttling, 
     1172no object is returned and the Comment Pending blog template is displayed. 
     1173 
     1174=head2 $app->handle_error 
     1175 
     1176Returns an error message to the user using the Comment Error blog template. 
     1177 
     1178=head1 APPLICATION MODES 
     1179 
     1180=head2 $app->commenter_name_js 
     1181 
     1182Returns some JavaScript code that sets the 'commenter_name' variable 
     1183based on the 'tk_commenter' cookie that is accessible to the comments 
     1184CGI script. 
     1185 
     1186=head2 $app->do_red 
     1187 
     1188Handles a commenter URL redirect, where the comment_id points to a 
     1189L<MT::Comment> object with a URL. The response redirects the user to 
     1190that URL. The comment must be approved and published. 
     1191 
     1192Note: This behavior has been deprecated in favor of using the 'nofollow' 
     1193plugin. 
     1194 
     1195=head2 $app->handle_sign_in 
     1196 
     1197Handles the sign-in process for a TypeKey-compatible sign-in request. 
     1198 
     1199=head2 $app->post 
     1200 
     1201Mode that handles posting of a new comment. 
     1202 
     1203=head2 $app->preview 
     1204 
     1205Mode for previewing a comment before posting. 
     1206 
     1207=head2 $app->view 
     1208 
     1209Mode for displaying a dynamic view of comments for a particular entry. 
     1210 
    11381211=head1 CALLBACKS 
    11391212 
    …… 
    11481221signature: 
    11491222 
    1150     sub comment_throttle_filter($eh, $app, $entry) 
     1223    sub comment_throttle_filter($cb, $app, $entry) 
    11511224    { 
    11521225        ... 
    …… 
    11701243be saved. The callback has the following signature: 
    11711244 
    1172     sub comment_filter($eh, $app, $comment) 
     1245    sub comment_filter($cb, $app, $comment) 
    11731246    { 
    11741247        ... 
    11751248    } 
    11761249 
     1250=head1 SPAM PROTECTION 
     1251 
     1252Spam filtering (or "Junk" filtering in MT terminology) is handled using 
     1253the L<MT::JunkFilter> package and plugins that implement them. Please 
     1254refer to that module for further documentation. 
     1255 
     1256=head1 AUTHOR & COPYRIGHT 
     1257 
     1258Please see the I<MT> manpage for author, copyright, and license information. 
     1259 
    11771260=back 

  • branches/mt3.34/lib/MT/App/Trackback.pm

    r600 r981  
    276276    $ping->title(defined $title && $title ne '' ? $title : $url); 
    277277    $ping->blog_name($blog_name); 
     278 
     279    # strip of any null characters (done after junk checks so they can 
     280    # monitor for that kind of activity) 
     281    for my $field (qw(title excerpt url blog_name)) { 
     282        my $val = $ping->column($field); 
     283        if ($val =~ m/\x00/) { 
     284            $val =~ tr/\x00//d; 
     285            $ping->column($field, $val); 
     286        } 
     287    } 
     288 
    278289    if (!MT->run_callbacks('TBPingFilter', $app, $ping)) { 
    279290        return $app->_response(Error => "", Code => 403); 
    …… 
    386397        } 
    387398        my %head = ( To => $author->email, 
    388                      From => $app->config('EmailAddressMain') || $author->email, 
     399                     From => $app->config('EmailAddressMain') || $author->emai 
     400l, 
    389401                     Subject => '[' . $blog->name . '] ' . $subj ); 
    390402        my $base; 
    …… 
    476488 
    4774891; 
     490__END__ 
     491 
     492=head1 NAME 
     493 
     494MT::App::Trackback 
     495 
     496=head1 METHODS 
     497 
     498=head2 init 
     499 
     500Call L<MT::App/init>, register the C<ping>, C<view> and C<rss> 
     501callbacks and set the application default_mode to C<ping>. 
     502 
     503=head2 view 
     504 
     505Build the trackback page for viewing. 
     506 
     507=head2 rss 
     508 
     509Generate and return RSS text for the trackback. 
     510 
     511=head2 blog 
     512 
     513Return the blog of the trackback. 
     514 
     515=head2 no_utf8 
     516 
     517This function removes UTF-8 from scalars. 
     518 
     519=head1 AUTHOR & COPYRIGHT 
     520 
     521Please see L<MT/AUTHOR & COPYRIGHT>. 
     522 
     523=cut 

  • branches/mt3.34/lib/MT/Sanitize.pm

    r691 r981  
    4747    my $class = shift; 
    4848    my($s, $arg) = @_; 
     49    $s = '' unless defined $s; 
     50    $s =~ tr/\x00//d; 
    4951    $arg = '1' unless defined $arg; 
    5052    return $s if $arg eq '0'; 
    …… 
    101103                if ($inside) { 
    102104                    my @attrs; 
    103                     while ($inside =~ m/([:\w]+)\s*=\s*(['"])(.*?)\2/gs) {  #"' 
     105                    while ($inside =~ m/([:\w]+)\s*=\s*(['"])(.*?)\2/gs) { 
    104106                        my ($attr, $q, $val) = (lc($1), $2, $3); 
    105107                        if ($ok_tags->{'*'}{$attr} || 
    …… 
    155157    } 
    156158    if (defined $last_pos && ($last_pos < length($s))) { 
    157         $out .= substr($s, $last_pos); 
    158     } 
    159     for my $tag (@open_tags) { 
    160         $out .= '</' . $tag . '>'; 
     159        if (substr($s, $last_pos) !~ m/</) { 
     160            $out .= substr($s, $last_pos); 
     161        } 
     162    } 
     163    if (@open_tags) { 
     164        $out .= _expel_up_to(\@open_tags, \%open_tags, ''); 
    161165    } 
    162166    $out; 
    …… 
    194198    ## $str is now <a href="foo.html">foolink</a> 
    195199 
     200=head1 METHODS 
     201 
     202=head2 parse_spec($tags) 
     203 
     204Return a hash reference of allowed tags and their attributes. 
     205 
     206=head2 sanitize($text, [0|1|\%args]) 
     207 
     208"Sanitize" the I<text> with the rules defined in I<args> (or by the 
     209C<parse_spec> method if rules are not provided). 
     210 
     211=head1 AUTHOR & COPYRIGHT 
     212 
     213Please see L<MT/AUTHOR & COPYRIGHT>. 
     214 
    196215=cut 
     216 
     217=cut 

  • branches/mt3.34/php/lib/sanitize_lib.php

    r695 r981  
    66    $ok_tags = $arg['ok']; 
    77    $tag_attr = $arg['tag_attr']; 
    8  
     8    $s = preg_replace('/\x00/', '', $s); 
    99    $closings = array('<'.'?' => '?'.'>', '<!--' => '-->', '<%' => '%>'); 
    1010    $tokens = preg_split('/(<(?:!--|%|\?)|<\/\w*|<\w*|(?:-->|%>|\?'.'>|>))/', $s, -1, PREG_SPLIT_DELIM_CAPTURE); 

  • branches/mt3.34/t/11-sanitize.t

    r2 r981  
    1 #!/usr/bin/perl -w 
     1#!/usr/bin/perl 
     2# $Id$ 
    23use strict; 
     4use warnings; 
     5 
     6use Test::More tests => 53; 
    37 
    48use MT; 
    59use MT::Sanitize; 
    6 use Test; 
    7  
    8 BEGIN { plan tests => 44 } 
    910 
    1011my($atts, $str); 
    1112 
    1213$atts = MT::Sanitize->parse_spec('a href'); 
    13 ok($atts->{ok}); 
    14 ok($atts->{ok}{a}); 
    15 ok($atts->{ok}{a}{href}); 
     14isa_ok($atts, 'HASH'); 
     15ok($atts->{ok}, '{ok}'); 
     16ok($atts->{ok}{a}, '{ok}{a}'); 
     17ok($atts->{ok}{a}{href}, '{ok}{a}{href}'); 
    1618 
    1719$atts = MT::Sanitize->parse_spec('a href,b'); 
    18 ok($atts->{ok}); 
    19 ok($atts->{ok}{a}); 
    20 ok($atts->{ok}{a}{href}); 
    21 ok($atts->{ok}{b}); 
     20isa_ok($atts, 'HASH'); 
     21ok($atts->{ok}, '{ok}'); 
     22ok($atts->{ok}{a}, '{ok}{a}'); 
     23ok($atts->{ok}{a}{href}, '{ok}{a}{href}'); 
     24ok($atts->{ok}{b}, '{ok}{b}'); 
    2225 
    2326$atts = MT::Sanitize->parse_spec('br/'); 
    24 ok($atts->{ok}); 
    25 ok($atts->{ok}{br}); 
    26 ok($atts->{tag_attr}{br}, '/'); 
     27isa_ok($atts, 'HASH'); 
     28ok($atts->{ok}, '{ok}'); 
     29ok($atts->{ok}{br}, '{ok}{br}'); 
     30is($atts->{tag_attr}{br}, '/', '{tag_attr}{br}=/'); 
    2731 
    2832$atts = MT::Sanitize->parse_spec('img/ src'); 
    29 ok($atts->{ok}); 
    30 ok($atts->{ok}{img}); 
    31 ok($atts->{ok}{img}{src}); 
    32 ok($atts->{tag_attr}{img}, '/'); 
     33isa_ok($atts, 'HASH'); 
     34ok($atts->{ok}, '{ok}'); 
     35ok($atts->{ok}{img}, '{ok}{img}'); 
     36ok($atts->{ok}{img}{src}, '{ok}{img}{src}'); 
     37is($atts->{tag_attr}{img}, '/', '{tag_attr}{img}=/'); 
    3338 
    3439$atts = MT::Sanitize->parse_spec('* align'); 
    35 ok($atts->{ok}); 
    36 ok($atts->{ok}{'*'}); 
    37 ok($atts->{ok}{'*'}{align}); 
     40isa_ok($atts, 'HASH'); 
     41ok($atts->{ok}, '{ok}'); 
     42ok($atts->{ok}{'*'}, "{ok}{'*'}"); 
     43ok($atts->{ok}{'*'}{align}, "{ok}{'*'}{align}"); 
    3844 
    3945$atts = MT::Sanitize->parse_spec('p,* align'); 
    40 ok($atts->{ok}); 
    41 ok($atts->{ok}{'*'}); 
    42 ok($atts->{ok}{'*'}{align}); 
    43 ok($atts->{ok}{p}); 
     46isa_ok($atts, 'HASH'); 
     47ok($atts->{ok}, '{ok}'); 
     48ok($atts->{ok}{'*'}, "{ok}{'*'}"); 
     49ok($atts->{ok}{'*'}{align}, "{ok}{'*'}{align}"); 
     50ok($atts->{ok}{p}, '{ok}{p}'); 
    4451 
    45 ok(!MT::Sanitize->sanitize('<?php readfile("/etc/passwd") ?>')); 
     52is(MT::Sanitize->sanitize('<?php readfile("/etc/passwd") ?>'), '', 'php passwd'); 
    4653 
    47 ok(!MT::Sanitize->sanitize('<? readfile("/etc/passwd") ?>')); 
     54is(MT::Sanitize->sanitize('<? readfile("/etc/passwd") ?>'), '', 'passwd'); 
    4855 
    49 ok(MT::Sanitize->sanitize('passwords! <? readfile("/etc/passwd") ?>'), 'passwords! '); 
     56is(MT::Sanitize->sanitize('passwords! <? readfile("/etc/passwd") ?>'), 'passwords! ', 'passwords! '); 
    5057 
    51 ok(!MT::Sanitize->sanitize('<? start some evil PHP')); 
     58is(MT::Sanitize->sanitize('<? start some evil PHP'), '', 'evil PHP'); 
    5259 
    53 ok(!MT::Sanitize->sanitize('<% some ASP code %>')); 
     60is(MT::Sanitize->sanitize('<% some ASP code %>'), '', 'ASP code'); 
    5461 
    55 ok(!MT::Sanitize->sanitize('<!--#exec cgi="/some/bad.cgi"-->')); 
     62is(MT::Sanitize->sanitize('<!--#exec cgi="/some/bad.cgi"-->'), '', 'exec cgi'); 
    5663 
    57 ok(!MT::Sanitize->sanitize('<script src="evil.js">')); 
     64is(MT::Sanitize->sanitize('<script src="evil.js">'), '', 'evil.js'); 
    5865 
    59 ok(MT::Sanitize->sanitize('foo'), 'foo'); 
     66is(MT::Sanitize->sanitize('foo'), 'foo', 'foo'); 
    6067 
    61 ok(MT::Sanitize->sanitize('<a href="foo.html" onclick="runEvilJS()">kittens</a>'), 'kittens'); 
     68is(MT::Sanitize->sanitize('<a href="foo.html" onclick="runEvilJS()">kittens</a>'), 'kittens', 'kittens'); 
    6269 
    63 ok(MT::Sanitize->sanitize('<a href="foo.html" onclick="runEvilJS()">kittens</a>', { ok => { a => {} } }), '<a>kittens</a>'); 
     70is(MT::Sanitize->sanitize('<a href="foo.html" onclick="runEvilJS()">kittens</a>', { ok => { a => {} } }), '<a>kittens</a>', '<a>kittens</a>'); 
    6471 
    65 ok(MT::Sanitize->sanitize('<a href="foo.html" onclick="runEvilJS()">kittens</a>', { ok => { a => { href => 1 } } }), '<a href="foo.html">kittens</a>'); 
     72is(MT::Sanitize->sanitize('<a href="foo.html" onclick="runEvilJS()">kittens</a>', { ok => { a => { href => 1 } } }), '<a href="foo.html">kittens</a>', '<a href="foo.html">kittens</a>'); 
    6673 
    67 ok(MT::Sanitize->sanitize('<code>code</code>'), 'code'); 
     74is(MT::Sanitize->sanitize('<code>code</code>'), 'code', 'code'); 
    6875 
    69 ok(MT::Sanitize->sanitize('<b>bold</b>', MT::Sanitize->parse_spec('b')), '<b>bold</b>'); 
     76is(MT::Sanitize->sanitize('<b>bold</b>', MT::Sanitize->parse_spec('b')), '<b>bold</b>', '<b>bold</b>'); 
    7077 
    71 ok(MT::Sanitize->sanitize('Some text<br />with a line break', MT::Sanitize->parse_spec('br/')), 'Some text<br />with a line break'); 
     78is(MT::Sanitize->sanitize('Some text<br />with a line break', MT::Sanitize->parse_spec('br/')), 'Some text<br />with a line break', 'Some text<br />with a line break'); 
    7279 
    73 ok(MT::Sanitize->sanitize('Some text<br>with a line break', MT::Sanitize->parse_spec('br/')), 'Some text<br />with a line break'); 
     80is(MT::Sanitize->sanitize('Some text<br>with a line break', MT::Sanitize->parse_spec('br/')), 'Some text<br />with a line break', 'Some text<br />with a line break'); 
    7481 
    75 ok(MT::Sanitize->sanitize('<img onmouseover="killComputer()" src="foo.jpg">', MT::Sanitize->parse_spec('img/ src')), '<img src="foo.jpg" />'); 
     82is(MT::Sanitize->sanitize('<img onmouseover="killComputer()" src="foo.jpg">', MT::Sanitize->parse_spec('img/ src')), '<img src="foo.jpg" />', '<img src="foo.jpg" />'); 
    7683 
    77 ok(MT::Sanitize->sanitize('<img onmouseover="killComputer()" src="foo.jpg">', 'img/ src'), '<img src="foo.jpg" />'); 
     84is(MT::Sanitize->sanitize('<img onmouseover="killComputer()" src="foo.jpg">', 'img/ src'), '<img src="foo.jpg" />', '<img src="foo.jpg" />'); 
    7885 
    79 ok(MT::Sanitize->sanitize('<b>open bold', 'b'), '<b>open bold</b>'); 
     86is(MT::Sanitize->sanitize('<b>open bold', 'b'), '<b>open bold</b>', '<b>open bold</b>'); 
    8087 
    81 ok(MT::Sanitize->sanitize('<b><i>open</b> italic', 'b,i'), '<b><i>open</i></b> italic'); 
     88is(MT::Sanitize->sanitize('<b><i>open</b> italic', 'b,i'), '<b><i>open</i></b> italic', '<b><i>open</i></b> italic'); 
    8289 
    83 ok(MT::Sanitize->sanitize('<a><b><blockquote><i>open</b> italic', 'b,i'), '<b><i>open</i></b> italic'); 
     90is(MT::Sanitize->sanitize('<a><b><blockquote><i>open</b> italic', 'b,i'), '<b><i>open</i></b> italic', '<b><i>open</i></b> italic'); 
    8491 
    85 ok(MT::Sanitize->sanitize('<a href="javascript:alert(\'xxx\')">boo</a>', 'a href'), '<a>boo</a>'); 
     92is(MT::Sanitize->sanitize('<a href="javascript:alert(\'xxx\')">boo</a>', 'a href'), '<a>boo</a>', '<a>boo</a>'); 
    8693 
    87 ok(MT::Sanitize->sanitize('<a href="jav&#x0D;ascript:alert(\'xxx\')">boo</a>', 'a href'), '<a>boo</a>'); 
     94is(MT::Sanitize->sanitize('<a href="jav&#x0D;ascript:alert(\'xxx\')">boo</a>', 'a href'), '<a>boo</a>', '<a>boo</a>'); 
    8895 
    89 ok(MT::Sanitize->sanitize('<a href="java&#x20;script.html">boo</a>', 'a href'), '<a href="java&#x20;script.html">boo</a>'); 
     96is(MT::Sanitize->sanitize('<a href="java&#x20;script.html">boo</a>', 'a href'), '<a href="java&#x20;script.html">boo</a>', '<a href="java&#x20;script.html">boo</a>'); 
     97 
     98is(MT::Sanitize->sanitize('<a href="javascript&#5' . chr(0) . '8;alert(\'boo\')">click</a>', 'a href'), '<a>click</a>', '<a href="javascript&5(null)8;alert(\'boo\')">click</a>'); 
     99 
     100is(MT::Sanitize->sanitize('<p><i style="x:expression:alert(\'xss\')"', 'p,i'), '<p></p>', '<p><i style="x:expression:alert(\'xss\')"'); 
    90101 
    91102### this one breaks... 
    92 ###ok(!MT::Sanitize->sanitize('<? /* ?> */ readfile("/etc/passwd") ?>')); 
     103is(MT::Sanitize->sanitize('<? /* ?> */ readfile("/etc/passwd") ?>'), ' */ readfile("/etc/passwd") ?>', 'php cloaking attempt');