[TikiWiki-commits] [Git][tikiwiki/tiki][master] [ENH] XSS vulnerability in PreventXss filter, add backslash to character class
"Elifeleti Mukisa Dan \(@Danelif\) via TikiWiki-cvs" <[email protected]>
| Newsgroups | gmane.comp.cms.tiki.cvs |
|---|---|
| Message-ID | <6a10a2887c4c9_38192594148d0@gitlab-sidekiq-low-urgency-cpu-bound-v2-5755d7f9f9-brfxh.mail> |
Elifeleti Mukisa Dan pushed to branch master at Tiki Wiki CMS Groupware / Tiki Commits: d63bd237 by Elifeleti Mukisa Dan at 2026-05-22T18:20:14+00:00 [ENH] XSS vulnerability in PreventXss filter, add backslash to character class --- * [ENH] XSS vulnerability in PreventXss filter, add backslash to character class (cherry picked from commit 1de5399c0c7e1c81cdfa82a01d9e66cfd1a3e0e6) Co-authored-by: Danelif <[email protected]> See merge request tikiwiki/tiki!10287 - - - - - 1 changed file: - lib/core/TikiFilter/PreventXss.php Changes: ===================================== lib/core/TikiFilter/PreventXss.php ===================================== @@ -147,7 +147,7 @@ class TikiFilter_PreventXss implements Laminas\Filter\FilterInterface while ( $this->RemoveXSSchars($val) || $this->RemoveXSSregexp($ra_as_tag_only, $val, '(\<|\[\\\\xC0\]\[\\\\xBC\])\??') - || $this->RemoveXSSregexp($ra_as_attribute, $val, '[\s\/"\']') + || $this->RemoveXSSregexp($ra_as_attribute, $val, '[\s\\\\\/"\']') || $this->RemoveXSSregexp($ra_as_content, $val, '[\.\\\\+\*\?\[\^\]\$\(\)\{\}\=\!\<\|\:;\-\/`#"\']', '(?!\s*[a-z0-9])', true) || $this->RemoveXSSregexp($ra_javascript, $val, '', ':', true) /// || RemoveXSSregexp($ra_style, $val, '[^a-z0-9]', '=') // Commented as it has been considered as a bit too aggressive View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/d63bd2376fc00e9278e8b8d06148329784f07ede -- View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/d63bd2376fc00e9278e8b8d06148329784f07ede You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help _______________________________________________ TikiWiki-cvs mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs