r13659 - in Products.PortalTransforms/branches/1.6: . Products/PortalTransforms/tests Products/PortalTransforms/transforms docs

Author: davisagli
Date: Thu Jun  2 03:55:31 2011
New Revision: 13659

Modified:
   Products.PortalTransforms/branches/1.6/   (props changed)
   Products.PortalTransforms/branches/1.6/Products/PortalTransforms/tests/test_xss.py
   Products.PortalTransforms/branches/1.6/Products/PortalTransforms/transforms/safe_html.py   (contents, props changed)
   Products.PortalTransforms/branches/1.6/docs/HISTORY.txt
Log:
merge fixes for CVE 2011-1949

Modified: Products.PortalTransforms/branches/1.6/Products/PortalTransforms/tests/test_xss.py
==============================================================================
--- Products.PortalTransforms/branches/1.6/Products/PortalTransforms/tests/test_xss.py	(original)
+++ Products.PortalTransforms/branches/1.6/Products/PortalTransforms/tests/test_xss.py	Thu Jun  2 03:55:31 2011
@@ -143,6 +143,26 @@
         data_in = '<<frame></frame>script>alert("XSS");<<frame></frame>/script>'
         data_out = '&lt;script&gt;alert("XSS");&lt;/script&gt;'
         self.doTest(data_in, data_out)
+    
+    def test_23(self):
+        data_in = """<a href="javascript&amp;#0:alert('1');">click me</a>"""
+        data_out = """<a>click me</a>"""
+        self.doTest(data_in, data_out)
+    
+    def test_24(self):
+        data_in = """<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">click me</a>"""
+        data_out = """<a>click me</a>"""
+        self.doTest(data_in, data_out)
+
+    def test_25(self):
+        data_in = """ <![<a href="javascript:alert('1');">click me</a>"""
+        data_out = " "
+        self.doTest(data_in, data_out)
+
+    def test_26(self):
+        data_in = """<a style="width: expression/**/(alert('xss'))">click me</a>"""
+        data_out = """<a>click me</a>"""
+        self.doTest(data_in, data_out)
 
 def test_suite():
     from unittest import TestSuite, makeSuite

Modified: Products.PortalTransforms/branches/1.6/Products/PortalTransforms/transforms/safe_html.py
==============================================================================
--- Products.PortalTransforms/branches/1.6/Products/PortalTransforms/transforms/safe_html.py	(original)
+++ Products.PortalTransforms/branches/1.6/Products/PortalTransforms/transforms/safe_html.py	Thu Jun  2 03:55:31 2011
@@ -41,19 +41,26 @@
 %s</d>
 """
 
+CSS_COMMENT = re.compile(r'/\*.*\*/')
 def hasScript(s):
     """Dig out evil Java/VB script inside an HTML attribute.
  
+    >>> hasScript('data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==')
+    True
     >>> hasScript('script:evil(1);')
     True
     >>> hasScript('expression:evil(1);')
     True
+    >>> hasScript('expression/**/:evil(1);')
+    True
     >>> hasScript('http://foo.com/ExpressionOfInterest.doc')
     False
     """
     s = decode_htmlentities(s)
+    s = s.replace('\x00', '')
+    s = CSS_COMMENT.sub('', s)
     s = ''.join(s.split()).lower()
-    for t in ('script:', 'expression:', 'expression('):
+    for t in ('script:', 'expression:', 'expression(', 'data:'):
         if t in s:
             return True
     return False
@@ -61,7 +68,7 @@
 def decode_htmlentities(s):
     """ XSS code can be hidden with htmlentities """
 
-    entity_pattern = re.compile("&#(?P<htmlentity>x?\w+)?;?")
+    entity_pattern = re.compile("&(amp;)?#(?P<htmlentity>x?\w+)?;?")
     s = entity_pattern.sub(decode_htmlentity,s)
     return s
 
@@ -177,9 +184,7 @@
             try:
                 j = SGMLParser.parse_declaration(self, i)
             except SGMLParseError:
-                toHandle = self.rawdata[i:]
-                self.result.append(toHandle)
-                j = i + len(toHandle)
+                j = len(self.rawdata)
         return j
 
     def getResult(self):

Modified: Products.PortalTransforms/branches/1.6/docs/HISTORY.txt
==============================================================================
--- Products.PortalTransforms/branches/1.6/docs/HISTORY.txt	(original)
+++ Products.PortalTransforms/branches/1.6/docs/HISTORY.txt	Thu Jun  2 03:55:31 2011
@@ -4,7 +4,21 @@
 1.6.13 - Unreleased
 -------------------
 
-* Fix missing security declarations.
+The following three changes collectively fix
+http://plone.org/products/plone/security/advisories/CVE-2011-1949
+
+* In the safe_html transform, abort parsing if a broken declaration is found.
+  [evilbungle, davisagli]
+
+* In the safe_html transform, remove data URIs.
+  [davisagli]
+
+* In the safe_html transform, ignore null bytes when checking for unsafe
+  attributes with scripts.
+  [davisagli]
+
+* Fix missing security declarations. This fixes part of
+  http://plone.org/products/plone/security/advisories/cve-2011-0720/
   [davisagli]
 
 1.6.12 - 2010-07-02

------------------------------------------------------------------------------
Simplify data backup and recovery for your virtual environment with vRanger. 
Installation's a snap, and flexible recovery options mean your data is safe,
secure and there when you need it. Data protection magic?
Nope - It's vRanger. Get your free trial download today. 
http://p.sf.net/sfu/quest-sfdev2dev