Skip to content
Snippets Groups Projects
Commit 63de11d9 authored by Apparao G's avatar Apparao G
Browse files

#1790:Issue fixed

parent ac9372b5
No related branches found
No related tags found
1 merge request!915#Fixed:1790:Logo vulnerability issue fixed in company. contact and product images.
...@@ -807,11 +807,11 @@ function purifyJavascriptAlert($value){ ...@@ -807,11 +807,11 @@ function purifyJavascriptAlert($value){
// skip javascript: contents check if tag is not available,as javascript: regex will cause performace issue if the contents will be large // skip javascript: contents check if tag is not available,as javascript: regex will cause performace issue if the contents will be large
if (preg_match_all('/(&.*?lt;|<)'.$tag.'[^>]*?(>|&.*?gt;)/i', $value,$matches)) { if (preg_match_all('/(&.*?lt;|<)'.$tag.'[^>]*?(>|&.*?gt;)/i', $value,$matches)) {
$javaScriptRegex = '/(&.*?lt;|<).?'.$tag.' [^>]*(j[\s]?a[\s]?v[\s]?a[\s]?s[\s]?c[\s]?r[\s]?i[\s]?p[\s]?t[\s]*[=&%#:])[^>]*?(>|&.*?gt;)/i'; $javaScriptRegex = '/(&.*?lt;|<).?'.$tag.'[^>]*(j[\s]?a[\s]?v[\s]?a[\s]?s[\s]?c[\s]?r[\s]?i[\s]?p[\s]?t[\s]*[=&%#:])[^>]*?(>|&.*?gt;)/i';
foreach($matches[0] as $matchedValue){ foreach($matches[0] as $matchedValue){
//strict check addded - if &tab;/&newLine added in the above tags we are replacing it to spaces. //strict check addded - if &tab;/&newLine added in the above tags we are replacing it to spaces.
$purifyContent = preg_replace('/&NewLine;|&amp;NewLine;|&Tab;|&amp;Tab;|\t/i',' ',$matchedValue); $purifyContent = preg_replace('/&NewLine;|&amp;NewLine;|&Tab;|&amp;Tab;|\t/i',' ',$purifyContent);
$purifyContent = preg_replace($javaScriptRegex,"<$tag>",$purifyContent); $purifyContent = preg_replace($javaScriptRegex,"<$tag>",decode_html($matchedValue));
$value = str_replace($matchedValue, $purifyContent, $value); $value = str_replace($matchedValue, $purifyContent, $value);
/* /*
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment