[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [BP][ENH] XSS vulnerability in PreventXss filter, add backslash to character class

Elifeleti Mukisa Dan pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
3269f3b1 by Elifeleti Mukisa Dan at 2026-05-23T11:04:28+00:00
[BP][ENH] XSS vulnerability in PreventXss filter,  add backslash to character class
---
* [BP][ENH] XSS vulnerability in PreventXss filter,  add backslash to character class
---
* [BP][ENH] XSS vulnerability in PreventXss filter,  add backslash to character class
---
* [BP][ENH] XSS vulnerability in PreventXss filter,  add backslash to character class
---
* [ENH] XSS vulnerability in PreventXss filter,  add backslash to character class
---
* [ENH] XSS vulnerability in PreventXss filter,  add backslash to character class


(cherry picked from commit 1de5399c0c7e1c81cdfa82a01d9e66cfd1a3e0e6)

Co-authored-by: Danelif <[email protected]>

See merge request tikiwiki/tiki!10287


(cherry picked from commit d63bd2376fc00e9278e8b8d06148329784f07ede)

48092e65 [ENH] XSS vulnerability in PreventXss filter,  add backslash to character class

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10302


(cherry picked from commit 962438f3d60f694b6c698458d7bd7f9af9f53c47)

0ede1571 [ENH] XSS vulnerability in PreventXss filter,  add backslash to character class

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10309

See merge request tikiwiki/tiki!10334

See merge request tikiwiki/tiki!10346

- - - - -


1 changed file:

- lib/core/TikiFilter/PreventXss.php


Changes:

=====================================
lib/core/TikiFilter/PreventXss.php
=====================================
@@ -152,7 +152,7 @@ class TikiFilter_PreventXss implements Laminas\Filter\FilterInterface
         while (
             $this->RemoveXSSchars($val)
             || $this->RemoveXSSregexp($ra_as_tag_only, $val, '(\<|\[\\\\xC0\]\[\\\\xBC\])\??')
-            || $this->RemoveXSSregexp($ra_as_attribute, $val, '[\s\/"\']')
+            || $this->RemoveXSSregexp($ra_as_attribute, $val, '[\s\\\\\/"\']')
             || $this->RemoveXSSregexp($ra_as_content, $val, '[\.\\\\+\*\?\[\^\]\$\(\)\{\}\=\!\<\|\:;\-\/`#"\']', '(?!\s*[a-z0-9])', true)
             || $this->RemoveXSSregexp($ra_javascript, $val, '', ':', true)
             ///     || RemoveXSSregexp($ra_style, $val, '[^a-z0-9]', '=') // Commented as it has been considered as a bit too aggressive



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3269f3b152f20d53f9b1ed900f283299eb8504c2

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3269f3b152f20d53f9b1ed900f283299eb8504c2
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs