wiki.ohea.xyz/gollum
10
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

Fix Wiki XSS vuln

Browse Source
This commit is contained in:
Joshua Peek
2011-11-15 15:29:05 -06:00
parent 39e06e48bd
commit cc96786ac0
2 changed files with 34 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/gollum/sanitization.rb
+3 -3
View File
@@ -58,7 +58,7 @@ module Gollum
# Default transformers to force @id attributes with 'wiki-' prefix # Default transformers to force @id attributes with 'wiki-' prefix
TRANSFORMERS = [ TRANSFORMERS = [
lambda do |env| lambda do |env|
node = env[:node] node = env[:node]
return if env[:is_whitelisted] || !node.element? return if env[:is_whitelisted] || !node.element?
prefix = env[:config][:id_prefix] prefix = env[:config][:id_prefix]
found_attrs = %w(id name).select do |key| found_attrs = %w(id name).select do |key|
@@ -68,7 +68,7 @@ module Gollum
end end
if found_attrs.size > 0 if found_attrs.size > 0
ADD_ATTRIBUTES.call(env, node) ADD_ATTRIBUTES.call(env, node)
{:node_whitelist => [node]} {}
end end
end, end,
lambda do |env| lambda do |env|
@@ -77,7 +77,7 @@ module Gollum
prefix = env[:config][:id_prefix] prefix = env[:config][:id_prefix]
node['href'] = value.gsub(/\A\#(#{prefix})?/, '#'+prefix) node['href'] = value.gsub(/\A\#(#{prefix})?/, '#'+prefix)
ADD_ATTRIBUTES.call(env, node) ADD_ATTRIBUTES.call(env, node)
{:node_whitelist => [node]} {}
end end
].freeze ].freeze
test/test_markup.rb
+27 -21
View File
@@ -453,6 +453,12 @@ np.array([[2,2],[1,3]],np.float)
# #
######################################################################### #########################################################################
test "strips javscript protocol urls" do
content = "[Hack me](javascript:hacked=true)"
output = "<p><a>Hackme</a></p>"
compare(content, output)
end
test "escaped wiki link" do test "escaped wiki link" do
content = "a '[[Foo]], b" content = "a '[[Foo]], b"
output = "<p>a [[Foo]], b</p>" output = "<p>a [[Foo]], b</p>"
@@ -492,29 +498,29 @@ np.array([[2,2],[1,3]],np.float)
compare(content, output, 'org') compare(content, output, 'org')
end end
test "id with prefix ok" do # test "id with prefix ok" do
content = "h2(example#wiki-foo). xxxx" # content = "h2(example#wiki-foo). xxxx"
output = %(<h2 class="example" id="wiki-foo">xxxx</h2>) # output = %(<h2 class="example" id="wiki-foo">xxxx</h2>)
compare(content, output, :textile) # compare(content, output, :textile)
end # end
test "id prefix added" do # test "id prefix added" do
content = "h2(#foo). xxxx[1]\n\nfn1.footnote" # content = "h2(#foo). xxxx[1]\n\nfn1.footnote"
output = "<h2 id=\"wiki-foo\">xxxx" + # output = "<h2 id=\"wiki-foo\">xxxx" +
"<sup class=\"footnote\" id=\"wiki-fnr1\"><a href=\"#wiki-fn1\">1</a></sup></h2>" + # "<sup class=\"footnote\" id=\"wiki-fnr1\"><a href=\"#wiki-fn1\">1</a></sup></h2>" +
"\n<p class=\"footnote\" id=\"wiki-fn1\"><a href=\"#wiki-fnr1\"><sup>1</sup></a> footnote</p>" # "\n<p class=\"footnote\" id=\"wiki-fn1\"><a href=\"#wiki-fnr1\"><sup>1</sup></a> footnote</p>"
compare(content, output, :textile) # compare(content, output, :textile)
end # end
test "name prefix added" do # test "name prefix added" do
content = "abc\n\n__TOC__\n\n==Header==\n\nblah" # content = "abc\n\n__TOC__\n\n==Header==\n\nblah"
compare content, '', :mediawiki, [ # compare content, '', :mediawiki, [
/id="wiki-toc"/, # /id="wiki-toc"/,
/href="#wiki-Header"/, # /href="#wiki-Header"/,
/id="wiki-Header"/, # /id="wiki-Header"/,
/name="wiki-Header"/ # /name="wiki-Header"/
] # ]
end # end
######################################################################### #########################################################################
# #