wikimedia/mediawiki-extensions-InputBox
1
0
Fork 0
mirror of https://gerrit.wikimedia.org/r/mediawiki/extensions/InputBox synced 2024-11-15 03:04:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Validate background colour to avoid arbitrary style attribute injection. Leads to XSS in versions of IE that support dynamic properties (IE<8, and IE 8 in quirks mode).

Browse source
This commit is contained in:
Tim Starling 2010-03-30 03:59:15 +00:00
parent ef03379a76
commit 6bdcff7eaf
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
InputBox.classes.php
View file

@ -510,7 +510,28 @@ class InputBox {
// Validate the width; make sure it's a valid, positive integer
$this->mWidth = intval( $this->mWidth <= 0 ? 50 : $this->mWidth );
// Validate background color
if ( !$this->isValidColor( $this->mBGColor ) ) {
$this->mBGColor = 'transparent';
}
wfProfileOut( __METHOD__ );
}
/**
* Do a security check on the bgcolor parameter
*/
public function isValidColor( $color ) {
$regex = <<<REGEX
/^ (
[a-zA-Z]* | # color names
\# [0-9a-f]{3} | # short hexadecimal
\# [0-9a-f]{6} | # long hexadecimal
rgb \s* \( \s* (
\d+ \s* , \s* \d+ \s* , \s* \d+ | # rgb integer
[0-9.]+% \s* , \s* [0-9.]+% \s* , \s* [0-9.]+% # rgb percent
) \s* \)
) $ /xi
REGEX;
return (bool) preg_match( $regex, $color );
}
}