Merge pull request #461 from nanasess/add-script-escape

`<svg.*on.*?>|<img.*on.*?>` はマッチする範囲が広すぎるため onload|onerror にサニタイズ対象を限定する
EC-CUBE · May 13, 2021 · 5d5509d · 5d5509d
2 parents 2575786 + cefd605
commit 5d5509d
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/data/Smarty/templates/admin/home.tpl b/data/Smarty/templates/admin/home.tpl
@@ -29,8 +29,8 @@
         <!--{foreach item=info from=$arrInfo}-->
             <dl class="home-info-item">
                 <dt class="date"><!--{$info.disp_date|sfDispDBDate:false|h}--></dt>
-                <dt class="title"><!--{$info.title}--></dt>
-                <dd class="body"><!--{$info.body}--></dd>
+                <dt class="title"><!--{$info.title nofilter}--></dt>
+                <dd class="body"><!--{$info.body nofilter}--></dd>
             </dl>
         <!--{/foreach}-->
     </div>

diff --git a/data/smarty_extends/modifier.script_escape.php b/data/smarty_extends/modifier.script_escape.php
@@ -9,7 +9,7 @@ function smarty_modifier_script_escape($value)
 {
     if (is_array($value)) return $value;
 
-    $pattern = "/<script.*?>|<\/script>|javascript:|<svg.*on.*?>|<img.*on.*?>|<body.*onload.*?>|<iframe.*?>|<object.*?>|<embed.*?>|<.*onmouse.*?>/i";
+    $pattern = "/<script.*?>|<\/script>|javascript:|<svg.*(onload|onerror).*?>|<img.*(onload|onerror).*?>|<body.*onload.*?>|<iframe.*?>|<object.*?>|<embed.*?>|<.*onmouse.*?>/i";
     $convert = '#script tag escaped#';
 
     if (preg_match_all($pattern, $value, $matches)) {