smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-03 01:44:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'js_escape_security_fix_31' into support/3.1

Browse Source
This commit is contained in:
Simon Wisselink
2023-03-28 21:41:31 +02:00
parent e58c3dde4d 7677db7bc9
commit e09df8d851
4 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libs/plugins/modifier.escape.php
View File

@@ -188,7 +188,9 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
'<!--' => '<\!--', '<!--' => '<\!--',
'<s' => '<\s', '<s' => '<\s',
'<S' => '<\S' '<S' => '<\S',
"`" => "\\\\`",
"\${" => "\\\\\\$\\{"
) )
); );
case 'mail': case 'mail':

4
libs/plugins/modifiercompiler.escape.php
View File

@@ -92,7 +92,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
return 'strtr(' . return 'strtr(' .
$params[ 0 ] . $params[ 0 ] .
', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))'; ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r",
"\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S",
"`" => "\\\\`", "\${" => "\\\\\\$\\{"))';
} }
} catch (SmartyException $e) { } catch (SmartyException $e) {
// pass through to regular plugin fallback // pass through to regular plugin fallback

21
tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierEscapeTest.php
View File

@@ -207,4 +207,25 @@ class PluginModifierEscapeTest extends PHPUnit_Smarty
$this->assertEquals("sma'rty@&#187;example&#171;.com", $this->smarty->fetch($tpl)); $this->assertEquals("sma'rty@&#187;example&#171;.com", $this->smarty->fetch($tpl));
Smarty::$_MBSTRING = true; Smarty::$_MBSTRING = true;
} }
public function testTemplateLiteralBackticks()
{
$tpl = $this->smarty->createTemplate('string:{"`Hello, World!`"|escape:"javascript"}');
$this->assertEquals("\\`Hello, World!\\`", $this->smarty->fetch($tpl));
}
public function testTemplateLiteralInterpolation()
{
$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
$this->smarty->assign('vector', "`Hello, \${name}!`");
$this->assertEquals("\\`Hello, \\\$\\{name}!\\`", $this->smarty->fetch($tpl));
}
public function testTemplateLiteralBackticksAndInterpolation()
{
$this->smarty->assign('vector', '`${alert(`Hello, ${name}!`)}${`\n`}`');
$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
$this->assertEquals("\\`\\\$\\{alert(\\`Hello, \\\$\\{name}!\\`)}\\\$\\{\\`\\\\n\\`}\\`", $this->smarty->fetch($tpl));
}
} }

2
tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore vendored Normal file
View File

@@ -0,0 +1,2 @@
# Ignore anything in here, but keep this directory
*