r38307 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:< r38306‎ | r38307 | r38308 >
Date:16:43, 31 July 2008
Author:simetrical
Status:old
Tags:
Comment:
Fix what I'm quite sure is an XSS exploit in the CSS extension, from r38275. See post to Wikitech-l. This patch is untested, so feel free to revert if I'm wrong.
Modified paths:
  • /trunk/extensions/CSS/CSS.php (modified) (history)

Diff [purge]

Index: trunk/extensions/CSS/CSS.php
——@@ -41,12 +41,10 @@
4242 if (ereg('\\{', $css)) {
4343
4444 # Inline CSS
45 - $css = trim(Sanitizer::checkCss($css));
 45+ $css = htmlspecialchars(trim(Sanitizer::checkCss($css)));
4646 $parser->mOutput->addHeadItem( <<<EOT
4747 <style type="text/css">
48 -/*<![CDATA[*/
4948 {$css}
50 -/*]]>*/
5149 </style>
5250 EOT
5351 );

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r38275I meant to say should *not* use htmlspecialchars, it makes invalid CSS syntax...nad03:36, 31 July 2008

Status & tagging log