mirror of
https://github.com/smarty-php/smarty.git
synced 2026-08-04 20:44:13 +02:00
Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Simon Wisselink
|
5c0072430c | ||
|
Simon Wisselink
|
07de9164b7 |
+2
-14
@@ -6,23 +6,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
## [3.1.42] - 2022-01-10
|
||||
|
||||
### Security
|
||||
- Prevent arbitrary PHP code execution through maliciously crafted expression for the math function. This addresses CVE-2021-29454
|
||||
|
||||
## [3.1.41] - 2022-01-09
|
||||
|
||||
### Security
|
||||
- Rewrote the mailto function to not use `eval` when encoding with javascript
|
||||
|
||||
## [3.1.40] - 2021-10-13
|
||||
|
||||
### Changed
|
||||
- modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used https://github.com/smarty-php/smarty/pull/649
|
||||
|
||||
### Security
|
||||
- More advanced javascript escaping to handle https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements thanks to m-haritonov
|
||||
### Fixed
|
||||
- Fixed render crash when using inline include with a string template https://github.com/smarty-php/smarty/issues/639
|
||||
|
||||
## [3.1.39] - 2021-02-17
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ Smarty can be run with PHP 5.2 to PHP 7.4.
|
||||
|
||||
> Read the NEW_FEATURES and INHERITANCE_RELEASE_NOTES file for recent extensions to Smarty 3.1 functionality
|
||||
|
||||
Smarty versions 3.1.11 or later are now on GitHub and can be installed with Composer.
|
||||
Smarty versions 3.1.11 or later are now on github and can be installed with Composer.
|
||||
|
||||
|
||||
The "smarty/smarty" package will start at libs/.... subfolder.
|
||||
|
||||
@@ -111,7 +111,7 @@ class Smarty extends Smarty_Internal_TemplateBase
|
||||
/**
|
||||
* smarty version
|
||||
*/
|
||||
const SMARTY_VERSION = '3.1.42';
|
||||
const SMARTY_VERSION = '3.1.39';
|
||||
/**
|
||||
* define variable scopes
|
||||
*/
|
||||
|
||||
@@ -94,19 +94,22 @@ function smarty_function_mailto($params)
|
||||
);
|
||||
return;
|
||||
}
|
||||
// FIXME: (rodneyrehm) document.write() excues me what? 1998 has passed!
|
||||
if ($encode === 'javascript') {
|
||||
$string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
|
||||
$string = 'document.write(\'<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>\');';
|
||||
$js_encode = '';
|
||||
for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
|
||||
$js_encode .= '%' . bin2hex($string[ $x ]);
|
||||
}
|
||||
return '<script type="text/javascript">document.write(unescape(\'' . $js_encode . '\'))</script>';
|
||||
return '<script type="text/javascript">eval(unescape(\'' . $js_encode . '\'))</script>';
|
||||
} elseif ($encode === 'javascript_charcode') {
|
||||
$string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
|
||||
for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
|
||||
for ($x = 0, $y = strlen($string); $x < $y; $x++) {
|
||||
$ord[] = ord($string[ $x ]);
|
||||
}
|
||||
return '<script type="text/javascript">document.write(String.fromCharCode(' . implode(',', $ord) . '))</script>';
|
||||
$_ret = "<script type=\"text/javascript\" language=\"javascript\">\n" . "{document.write(String.fromCharCode(" .
|
||||
implode(',', $ord) . "))" . "}\n" . "</script>\n";
|
||||
return $_ret;
|
||||
} elseif ($encode === 'hex') {
|
||||
preg_match('!^(.*)(\?.*)$!', $address, $match);
|
||||
if (!empty($match[ 2 ])) {
|
||||
|
||||
@@ -28,12 +28,7 @@ function smarty_function_math($params, $template)
|
||||
'int' => true,
|
||||
'abs' => true,
|
||||
'ceil' => true,
|
||||
'acos' => true,
|
||||
'acosh' => true,
|
||||
'cos' => true,
|
||||
'cosh' => true,
|
||||
'deg2rad' => true,
|
||||
'rad2deg' => true,
|
||||
'exp' => true,
|
||||
'floor' => true,
|
||||
'log' => true,
|
||||
@@ -44,51 +39,27 @@ function smarty_function_math($params, $template)
|
||||
'pow' => true,
|
||||
'rand' => true,
|
||||
'round' => true,
|
||||
'asin' => true,
|
||||
'asinh' => true,
|
||||
'sin' => true,
|
||||
'sinh' => true,
|
||||
'sqrt' => true,
|
||||
'srand' => true,
|
||||
'atan' => true,
|
||||
'atanh' => true,
|
||||
'tan' => true,
|
||||
'tanh' => true
|
||||
'tan' => true
|
||||
);
|
||||
|
||||
// be sure equation parameter is present
|
||||
if (empty($params[ 'equation' ])) {
|
||||
trigger_error("math: missing equation parameter", E_USER_WARNING);
|
||||
return;
|
||||
}
|
||||
$equation = $params[ 'equation' ];
|
||||
|
||||
// Remove whitespaces
|
||||
$equation = preg_replace('/\s+/', '', $equation);
|
||||
|
||||
// Adapted from https://www.php.net/manual/en/function.eval.php#107377
|
||||
$number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
|
||||
$functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
|
||||
$operators = '[+\/*\^%-]'; // Allowed math operators
|
||||
$regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?2))?)+$/';
|
||||
|
||||
if (!preg_match($regexp, $equation)) {
|
||||
trigger_error("math: illegal characters", E_USER_WARNING);
|
||||
return;
|
||||
}
|
||||
|
||||
// make sure parenthesis are balanced
|
||||
if (substr_count($equation, '(') !== substr_count($equation, ')')) {
|
||||
trigger_error("math: unbalanced parenthesis", E_USER_WARNING);
|
||||
return;
|
||||
}
|
||||
|
||||
// disallow backticks
|
||||
if (strpos($equation, '`') !== false) {
|
||||
trigger_error("math: backtick character not allowed in equation", E_USER_WARNING);
|
||||
return;
|
||||
}
|
||||
|
||||
// also disallow dollar signs
|
||||
if (strpos($equation, '$') !== false) {
|
||||
trigger_error("math: dollar signs not allowed in equation", E_USER_WARNING);
|
||||
@@ -125,7 +96,6 @@ function smarty_function_math($params, $template)
|
||||
}
|
||||
$smarty_math_result = null;
|
||||
eval("\$smarty_math_result = " . $equation . ";");
|
||||
|
||||
if (empty($params[ 'format' ])) {
|
||||
if (empty($params[ 'assign' ])) {
|
||||
return $smarty_math_result;
|
||||
|
||||
@@ -184,11 +184,7 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
|
||||
'"' => '\\"',
|
||||
"\r" => '\\r',
|
||||
"\n" => '\\n',
|
||||
'</' => '<\/',
|
||||
// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
|
||||
'<!--' => '<\!--',
|
||||
'<s' => '<\s',
|
||||
'<S' => '<\S'
|
||||
'</' => '<\/'
|
||||
)
|
||||
);
|
||||
case 'mail':
|
||||
|
||||
@@ -89,10 +89,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
|
||||
return 'preg_replace("%(?<!\\\\\\\\)\'%", "\\\'",' . $params[ 0 ] . ')';
|
||||
case 'javascript':
|
||||
// escape quotes and backslashes, newlines, etc.
|
||||
// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
|
||||
return 'strtr(' .
|
||||
$params[ 0 ] .
|
||||
', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
|
||||
', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/" ))';
|
||||
}
|
||||
} catch (SmartyException $e) {
|
||||
// pass through to regular plugin fallback
|
||||
|
||||
@@ -317,7 +317,7 @@ class Smarty_Internal_Template extends Smarty_Internal_TemplateBase
|
||||
$tpl->template_resource = $template;
|
||||
$tpl->cache_id = $cache_id;
|
||||
$tpl->compile_id = $compile_id;
|
||||
if (isset($uid)) {
|
||||
if (isset($uid) && isset($tpl->compiled->file_dependency[ $uid ])) {
|
||||
// for inline templates we can get all resource information from file dependency
|
||||
list($filepath, $timestamp, $type) = $tpl->compiled->file_dependency[ $uid ];
|
||||
$tpl->source = new Smarty_Template_Source($smarty, $filepath, $type, $filepath);
|
||||
|
||||
+2
-9
@@ -1,11 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [[ "$1" =~ ^3\.[0-9\.-rc]+$ ]]; then
|
||||
printf 'Creating release %s\n' "$1"
|
||||
else
|
||||
echo "Invalid version number: $1. This script can only make v3.x.x releases."
|
||||
exit 1;
|
||||
fi
|
||||
printf 'Creating release %s\n' "$1"
|
||||
|
||||
git checkout -b "release/$1"
|
||||
sed -i "s/## \\[Unreleased\\]/## \\[Unreleased\\]\\n\\n## \\[$1\\] - $(date +%Y-%m-%d)/" CHANGELOG.md
|
||||
@@ -14,13 +9,11 @@ sed -i "s/const SMARTY_VERSION = '[^']\+';/const SMARTY_VERSION = '$1';/" libs/S
|
||||
git add CHANGELOG.md libs/Smarty.class.php
|
||||
git commit -m "version bump"
|
||||
|
||||
git checkout support/3.1
|
||||
git checkout master
|
||||
git pull
|
||||
git merge --no-ff "release/$1"
|
||||
git branch -d "release/$1"
|
||||
git tag -a "v$1" -m "Release $1"
|
||||
|
||||
printf 'Done creating release %s\n' "$1"
|
||||
|
||||
# shellcheck disable=SC2016
|
||||
printf 'Run `git push --follow-tags origin` to publish it.\n'
|
||||
|
||||
@@ -324,4 +324,12 @@ class CompileIncludeTest extends PHPUnit_Smarty
|
||||
array("A{include file='include_spacing3.tpl'}B\nC", "AbarB\nC", '3_Newline3', $i++),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test Inline Include with string template
|
||||
*/
|
||||
public function testInlineStringInclude()
|
||||
{
|
||||
$this->assertEquals('include-inline', $this->smarty->fetch('inline_string_include.tpl'));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
{include "string:include-inline" inline}
|
||||
@@ -54,7 +54,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
|
||||
|
||||
public function testEncodeJavascript()
|
||||
{
|
||||
$result = '<script type="text/javascript">document.write(unescape(\'%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%3c%2f%61%3e\'))</script>';
|
||||
$result = '<script type="text/javascript">eval(unescape(\'%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%3c%2f%61%3e%27%29%3b\'))</script>';
|
||||
$tpl = $this->smarty->createTemplate('eval:{mailto address="me@example.com" encode="javascript"}');
|
||||
$this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
|
||||
}
|
||||
@@ -62,7 +62,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
|
||||
public function testEncodeJavascriptWithoutMbstring()
|
||||
{
|
||||
Smarty::$_MBSTRING = false;
|
||||
$result = '<script type="text/javascript">document.write(unescape(\'%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%3c%2f%61%3e\'))</script>';
|
||||
$result = '<script type="text/javascript">eval(unescape(\'%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%3c%2f%61%3e%27%29%3b\'))</script>';
|
||||
$tpl = $this->smarty->createTemplate('eval:{mailto address="me@example.com" encode="javascript"}');
|
||||
$this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
|
||||
Smarty::$_MBSTRING = true;
|
||||
@@ -70,7 +70,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
|
||||
|
||||
public function testEncodeJavascriptCharcode()
|
||||
{
|
||||
$result = '<script type="text/javascript">document.write(String.fromCharCode(60,97,32,104,114,101,102,61,34,109,97,105,108,116,111,58,109,101,64,101,120,97,109,112,108,101,46,99,111,109,34,32,62,109,101,64,101,120,97,109,112,108,101,46,99,111,109,60,47,97,62))</script>';
|
||||
$result = "<script type=\"text/javascript\" language=\"javascript\">\n{document.write(String.fromCharCode(60,97,32,104,114,101,102,61,34,109,97,105,108,116,111,58,109,101,64,101,120,97,109,112,108,101,46,99,111,109,34,32,62,109,101,64,101,120,97,109,112,108,101,46,99,111,109,60,47,97,62))}\n</script>\n";
|
||||
$tpl = $this->smarty->createTemplate('eval:{mailto address="me@example.com" encode="javascript_charcode"}');
|
||||
$this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
|
||||
}
|
||||
@@ -78,7 +78,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
|
||||
public function testEncodeJavascriptCharcodeWithoutMbstring()
|
||||
{
|
||||
Smarty::$_MBSTRING = false;
|
||||
$result = '<script type="text/javascript">document.write(String.fromCharCode(60,97,32,104,114,101,102,61,34,109,97,105,108,116,111,58,109,101,64,101,120,97,109,112,108,101,46,99,111,109,34,32,62,109,101,64,101,120,97,109,112,108,101,46,99,111,109,60,47,97,62))</script>';
|
||||
$result = "<script type=\"text/javascript\" language=\"javascript\">\n{document.write(String.fromCharCode(60,97,32,104,114,101,102,61,34,109,97,105,108,116,111,58,109,101,64,101,120,97,109,112,108,101,46,99,111,109,34,32,62,109,101,64,101,120,97,109,112,108,101,46,99,111,109,60,47,97,62))}\n</script>\n";
|
||||
$tpl = $this->smarty->createTemplate('eval:{mailto address="me@example.com" encode="javascript_charcode"}');
|
||||
$this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
|
||||
Smarty::$_MBSTRING = true;
|
||||
|
||||
@@ -107,35 +107,4 @@ class MathTest extends PHPUnit_Smarty
|
||||
$tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="x * y" x=$x y=$y format="%0.2f"} -- {math equation="20.5 / 5" format="%0.2f"}');
|
||||
$this->assertEquals($expected, $this->smarty->fetch($tpl));
|
||||
}
|
||||
|
||||
/**
|
||||
* @expectedException PHPUnit_Framework_Error_Warning
|
||||
*/
|
||||
public function testBackticksIllegal()
|
||||
{
|
||||
$expected = "22.00";
|
||||
$tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="`ls` x * y" x=$x y=$y}');
|
||||
$this->assertEquals($expected, $this->smarty->fetch($tpl));
|
||||
}
|
||||
|
||||
/**
|
||||
* @expectedException PHPUnit_Framework_Error_Warning
|
||||
*/
|
||||
public function testDollarSignsIllegal()
|
||||
{
|
||||
$expected = "22.00";
|
||||
$tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="$" x=$x y=$y}');
|
||||
$this->assertEquals($expected, $this->smarty->fetch($tpl));
|
||||
}
|
||||
|
||||
/**
|
||||
* @expectedException PHPUnit_Framework_Error_Warning
|
||||
*/
|
||||
public function testBracketsIllegal()
|
||||
{
|
||||
$expected = "I";
|
||||
$tpl = $this->smarty->createTemplate('eval:{$x = "0"}{$y = "1"}{math equation="((y/x).(x))[x]" x=$x y=$y}');
|
||||
$this->assertEquals($expected, $this->smarty->fetch($tpl));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user