jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

make sure that markdown uses safe mode (#2961)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-19 23:07:27 +01:00
committed by GitHub
parent 9470699798
commit 76e09447c8
4 changed files with 39 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Twig/Runtime/MarkdownExtension.php
View File

@@ -61,7 +61,7 @@ final class MarkdownExtension implements RuntimeExtensionInterface
} }
if ($this->isMarkdownEnabled()) { if ($this->isMarkdownEnabled()) {
$content = $this->markdown->toHtml($content, false); $content = $this->markdown->toHtml($content);
} elseif ($fullLength) { } elseif ($fullLength) {
$content = '<p>' . nl2br($content) . '</p>'; $content = '<p>' . nl2br($content) . '</p>';
} }
@@ -112,7 +112,7 @@ final class MarkdownExtension implements RuntimeExtensionInterface
} }
if ($this->isMarkdownEnabled()) { if ($this->isMarkdownEnabled()) {
return $this->markdown->toHtml($content, false); return $this->markdown->toHtml($content);
} }
return nl2br($content); return nl2br($content);
@@ -126,6 +126,6 @@ final class MarkdownExtension implements RuntimeExtensionInterface
*/ */
public function markdownToHtml(string $content): string public function markdownToHtml(string $content): string
{ {
return $this->markdown->toHtml($content, false); return $this->markdown->toHtml($content);
} }
} }

7
src/Utils/Markdown.php
View File

@@ -33,7 +33,12 @@ final class Markdown
*/ */
public function toHtml(string $text, bool $safe = true): string public function toHtml(string $text, bool $safe = true): string
{ {
$this->parser->setSafeMode($safe); if ($safe !== true) {
@trigger_error('Only safe mode is supported in Markdown since 1.16.3 to prevent XSS attacks. Parameter $safe will be removed with 2.0', E_USER_DEPRECATED);
}
$this->parser->setSafeMode(true);
$this->parser->setMarkupEscaped(true);
return $this->parser->text($text); return $this->parser->text($text);
} }

12
tests/Twig/Runtime/MarkdownExtensionTest.php
View File

@@ -27,6 +27,10 @@ class MarkdownExtensionTest extends TestCase
$sut = new MarkdownExtension(new Markdown(), $config); $sut = new MarkdownExtension(new Markdown(), $config);
$this->assertEquals('<p><em>test</em></p>', $sut->markdownToHtml('*test*')); $this->assertEquals('<p><em>test</em></p>', $sut->markdownToHtml('*test*'));
$this->assertEquals('<p># foobar</p>', $sut->markdownToHtml('# foobar')); $this->assertEquals('<p># foobar</p>', $sut->markdownToHtml('# foobar'));
$this->assertEquals(
'<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
$sut->markdownToHtml('[XSS](javascript:alert(`XSS`))')
);
} }
public function testTimesheetContent() public function testTimesheetContent()
@@ -47,6 +51,10 @@ class MarkdownExtensionTest extends TestCase
"<ul>\n<li>test</li>\n<li>foo</li>\n</ul>\n<p>foo <strong>bar</strong></p>", "<ul>\n<li>test</li>\n<li>foo</li>\n</ul>\n<p>foo <strong>bar</strong></p>",
$sut->timesheetContent("- test\n- foo\n\nfoo __bar__") $sut->timesheetContent("- test\n- foo\n\nfoo __bar__")
); );
$this->assertEquals(
'<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
$sut->timesheetContent('[XSS](javascript:alert(`XSS`))')
);
} }
public function testCommentContent() public function testCommentContent()
@@ -76,6 +84,10 @@ class MarkdownExtensionTest extends TestCase
"<ul>\n<li>test</li>\n<li>foo</li>\n</ul>\n<p>foo <strong>bar</strong></p>", "<ul>\n<li>test</li>\n<li>foo</li>\n</ul>\n<p>foo <strong>bar</strong></p>",
$sut->commentContent("- test\n- foo\n\nfoo __bar__") $sut->commentContent("- test\n- foo\n\nfoo __bar__")
); );
$this->assertEquals(
'<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
$sut->commentContent('[XSS](javascript:alert(`XSS`))')
);
} }
public function testCommentOneLiner() public function testCommentOneLiner()

18
tests/Utils/MarkdownTest.php
View File

@@ -81,6 +81,24 @@ EOT;
## test ## test
### test ### test
# test # test
EOT;
$this->assertEquals($html, $sut->toHtml($markdown));
}
public function testLinksAreSanitized()
{
$sut = new Markdown();
$html = <<<'EOT'
<p><a href="javascript%3Aalert(`XSS`)">XSS</a><br />
<a href="javascript%3Aalert(&quot;XSS&quot;)">XSS</a><br />
<a href="javascript%3Aalert(&#039;XSS&#039;)">XSS</a></p>
EOT;
$markdown = <<<EOT
[XSS](javascript:alert(`XSS`))
[XSS](javascript:alert("XSS"))
[XSS](javascript:alert('XSS'))
EOT; EOT;
$this->assertEquals($html, $sut->toHtml($markdown)); $this->assertEquals($html, $sut->toHtml($markdown));
} }