diff options
| author | Joey Hess <joey@kodama.kitenet.net> | 2008-02-10 13:16:40 -0500 |
|---|---|---|
| committer | Joey Hess <joey@kodama.kitenet.net> | 2008-02-10 13:16:40 -0500 |
| commit | d7e0c035e55e8b47a9ea7e993c9332a7ce9930e1 (patch) | |
| tree | cef92b7f0d644db57673bf8d3d35008cede00816 /IkiWiki/Plugin | |
| parent | 196d27cbbc868f82ce9e598b0d7d1a8c460a52c6 (diff) | |
| download | ikiwiki-d7e0c035e55e8b47a9ea7e993c9332a7ce9930e1.tar ikiwiki-d7e0c035e55e8b47a9ea7e993c9332a7ce9930e1.tar.gz | |
* htmlscrubber security fix: Block javascript in uris.
* Add htmlscrubber test suite.
Diffstat (limited to 'IkiWiki/Plugin')
| -rw-r--r-- | IkiWiki/Plugin/htmlscrubber.pm | 36 |
1 files changed, 31 insertions, 5 deletions
diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm index bc613f924..25caa8a50 100644 --- a/IkiWiki/Plugin/htmlscrubber.pm +++ b/IkiWiki/Plugin/htmlscrubber.pm @@ -18,6 +18,28 @@ my $_scrubber; sub scrubber { #{{{ return $_scrubber if defined $_scrubber; + # Only known uri schemes are allowed to avoid all the ways of + # embedding javascrpt. + # List at http://en.wikipedia.org/wiki/URI_scheme + my $uri_schemes=join("|", + # IANA registered schemes + "http", "https", "ftp", "mailto", "file", "telnet", "gopher", + "aaa", "aaas", "acap", "cap", "cid", "crid", + "dav", "dict", "dns", "fax", "go", "h323", "im", "imap", + "ldap", "mid", "news", "nfs", "nntp", "pop", "pres", + "sip", "sips", "snmp", "tel", "urn", "wais", "xmpp", + "z39.50r", "z39.50s", + # data is a special case. Allow data:text/<image>, but + # disallow data:text/javascript and everything else. + qr/data:text\/(?:png|gif|jpeg)/, + # Selected unofficial schemes + "about", "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg", + "irc", "ircs", "lastfm", "ldaps", "magnet", "mms", + "msnim", "notes", "rsync", "secondlife", "skype", "ssh", + "sftp", "sms", "steam", "webcal", "ymsgr", + ); + my $link=qr/^(?:$uri_schemes:|[^:]+$)/i; + eval q{use HTML::Scrubber}; error($@) if $@; # Lists based on http://feedparser.org/docs/html-sanitization.html @@ -35,23 +57,27 @@ sub scrubber { #{{{ }], default => [undef, { ( map { $_ => 1 } qw{ - abbr accept accept-charset accesskey action + abbr accept accept-charset accesskey align alt axis border cellpadding cellspacing char charoff charset checked cite class clear cols colspan color compact coords datetime dir disabled enctype for frame - headers height href hreflang hspace id ismap + headers height hreflang hspace id ismap label lang longdesc maxlength media method multiple name nohref noshade nowrap prompt readonly rel rev rows rowspan rules scope - selected shape size span src start summary + selected shape size span start summary tabindex target title type usemap valign value vspace width - poster autoplay loopstart loopend end + autoplay loopstart loopend end playcount controls } ), "/" => 1, # emit proper <hr /> XHTML - }], + href => $link, + src => $link, + action => $link, + poster => $link, + }], ); return $_scrubber; } # }}} |