r13657 - in Products.PortalTransforms/trunk: . Products/PortalTransforms/tests Products/PortalTransforms/transforms

Author: davisagli
Date: Thu Jun  2 03:28:42 2011
New Revision: 13657

Modified:
   Products.PortalTransforms/trunk/CHANGES.txt
   Products.PortalTransforms/trunk/Products/PortalTransforms/tests/test_xss.py
   Products.PortalTransforms/trunk/Products/PortalTransforms/transforms/safe_html.py
Log:
adapt fixes from PloneHotfix20110531

Modified: Products.PortalTransforms/trunk/CHANGES.txt
==============================================================================
--- Products.PortalTransforms/trunk/CHANGES.txt	(original)
+++ Products.PortalTransforms/trunk/CHANGES.txt	Thu Jun  2 03:28:42 2011
@@ -4,6 +4,18 @@
 2.0.7 - unreleased
 ------------------
 
+The following three changes collectively fix
+http://plone.org/products/plone/security/advisories/CVE-2011-1949
+
+- In the safe_html transform, abort parsing if a broken declaration is found.
+  [evilbungle, davisagli]
+
+- In the safe_html transform, remove data URIs.
+  [davisagli]
+
+- In the safe_html transform, ignore null bytes when checking for unsafe
+  attributes with scripts.
+  [davisagli]
 
 2.0.6 - 2011-04-03
 ------------------

Modified: Products.PortalTransforms/trunk/Products/PortalTransforms/tests/test_xss.py
==============================================================================
--- Products.PortalTransforms/trunk/Products/PortalTransforms/tests/test_xss.py	(original)
+++ Products.PortalTransforms/trunk/Products/PortalTransforms/tests/test_xss.py	Thu Jun  2 03:28:42 2011
@@ -135,7 +135,26 @@
         data_in = '<<frame></frame>script>alert("XSS");<<frame></frame>/script>'
         data_out = '&lt;script&gt;alert("XSS");&lt;/script&gt;'
         self.doTest(data_in, data_out)
+    
+    def test_23(self):
+        data_in = """<a href="javascript&amp;#0:alert('1');">click me</a>"""
+        data_out = """<a>click me</a>"""
+        self.doTest(data_in, data_out)
+    
+    def test_24(self):
+        data_in = """<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">click me</a>"""
+        data_out = """<a>click me</a>"""
+        self.doTest(data_in, data_out)
 
+    def test_25(self):
+        data_in = """<![<a href="javascript:alert('1');">click me</a>"""
+        data_out = ""
+        self.doTest(data_in, data_out)
+
+    def test_26(self):
+        data_in = """<a style="width: expression/**/(alert('xss'))">click me</a>"""
+        data_out = """<a>click me</a>"""
+        self.doTest(data_in, data_out)
 
 def test_suite():
     from unittest import TestSuite, makeSuite

Modified: Products.PortalTransforms/trunk/Products/PortalTransforms/transforms/safe_html.py
==============================================================================
--- Products.PortalTransforms/trunk/Products/PortalTransforms/transforms/safe_html.py	(original)
+++ Products.PortalTransforms/trunk/Products/PortalTransforms/transforms/safe_html.py	Thu Jun  2 03:28:42 2011
@@ -73,20 +73,26 @@
 %s</d>
 """
 
-
+CSS_COMMENT = re.compile(r'/\*.*\*/')
 def hasScript(s):
     """Dig out evil Java/VB script inside an HTML attribute.
 
+    >>> hasScript('data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==')
+    True
     >>> hasScript('script:evil(1);')
     True
     >>> hasScript('expression:evil(1);')
     True
+    >>> hasScript('expression/**/:evil(1);')
+    True
     >>> hasScript('http://foo.com/ExpressionOfInterest.doc')
     False
     """
     s = decode_htmlentities(s)
+    s = s.replace('\x00', '')
+    s = CSS_COMMENT.sub('', s)
     s = ''.join(s.split()).lower()
-    for t in ('script:', 'expression:', 'expression('):
+    for t in ('script:', 'expression:', 'expression(', 'data:'):
         if t in s:
             return True
     return False
@@ -220,9 +226,7 @@
             try:
                 j = SGMLParser.parse_declaration(self, i)
             except SGMLParseError:
-                toHandle = self.rawdata[i:]
-                self.result.append(toHandle)
-                j = i + len(toHandle)
+                j = len(self.rawdata)
         return j
 
     def getResult(self):

------------------------------------------------------------------------------
Simplify data backup and recovery for your virtual environment with vRanger. 
Installation's a snap, and flexible recovery options mean your data is safe,
secure and there when you need it. Data protection magic?
Nope - It's vRanger. Get your free trial download today. 
http://p.sf.net/sfu/quest-sfdev2dev