| Index: trunk/extensions/VisualEditor/modules/parser/ext.core.Sanitizer.js |
| — | — | @@ -99,12 +99,25 @@ |
| 100 | 100 | if ( kv.v.constructor === Array ) { |
| 101 | 101 | kv.v = this.manager.env.tokensToString ( kv.v ); |
| 102 | 102 | } |
| | 103 | + if ( kv.k === 'style' ) { |
| | 104 | + kv.v = this.checkCss(kv.v); |
| | 105 | + } |
| 103 | 106 | } |
| 104 | 107 | } |
| 105 | 108 | // XXX: Validate attributes |
| 106 | 109 | return { token: token }; |
| 107 | 110 | }; |
| 108 | 111 | |
| | 112 | +Sanitizer.prototype.checkCss = function ( value ) { |
| | 113 | + if (/[\000-\010\016-\037\177]/.test(value)) { |
| | 114 | + return '/* invalid control char */'; |
| | 115 | + } |
| | 116 | + if (/expression|filter\s*:|accelerator\s*:|url\s*\(/i.test(value)) { |
| | 117 | + return '/* insecure input */'; |
| | 118 | + } |
| | 119 | + return value; |
| | 120 | +}; |
| | 121 | + |
| 109 | 122 | if (typeof module == "object") { |
| 110 | 123 | module.exports.Sanitizer = Sanitizer; |
| 111 | 124 | } |