* meta: Check that the urls provided for authorurl, permalink, and openid
are safe and can't contain javascript.master
parent
4bfdbd4858
commit
bbcf878f75
|
@ -38,6 +38,17 @@ sub scrub ($) { #{{{
|
|||
}
|
||||
} #}}}
|
||||
|
||||
sub safeurl ($) { #{{{
|
||||
my $url=shift;
|
||||
if (exists $IkiWiki::Plugin::htmlscrubber::{safe_url_regexp} &&
|
||||
defined $IkiWiki::Plugin::htmlscrubber::safe_url_regexp) {
|
||||
return $url=~/$IkiWiki::Plugin::htmlscrubber::safe_url_regexp/;
|
||||
}
|
||||
else {
|
||||
return 1;
|
||||
}
|
||||
} #}}}
|
||||
|
||||
sub htmlize ($$$) { #{{{
|
||||
my $page = shift;
|
||||
my $destpage = shift;
|
||||
|
@ -88,7 +99,7 @@ sub preprocess (@) { #{{{
|
|||
# fallthorough
|
||||
}
|
||||
elsif ($key eq 'authorurl') {
|
||||
$pagestate{$page}{meta}{authorurl}=$value;
|
||||
$pagestate{$page}{meta}{authorurl}=$value if safeurl($value);
|
||||
# fallthrough
|
||||
}
|
||||
|
||||
|
@ -106,8 +117,10 @@ sub preprocess (@) { #{{{
|
|||
}
|
||||
}
|
||||
elsif ($key eq 'permalink') {
|
||||
$pagestate{$page}{meta}{permalink}=$value;
|
||||
push @{$metaheaders{$page}}, scrub('<link rel="bookmark" href="'.encode_entities($value).'" />');
|
||||
if (safeurl($value)) {
|
||||
$pagestate{$page}{meta}{permalink}=$value;
|
||||
push @{$metaheaders{$page}}, scrub('<link rel="bookmark" href="'.encode_entities($value).'" />');
|
||||
}
|
||||
}
|
||||
elsif ($key eq 'stylesheet') {
|
||||
my $rel=exists $params{rel} ? $params{rel} : "alternate stylesheet";
|
||||
|
@ -124,12 +137,14 @@ sub preprocess (@) { #{{{
|
|||
"\" type=\"text/css\" />";
|
||||
}
|
||||
elsif ($key eq 'openid') {
|
||||
if (exists $params{server}) {
|
||||
if (exists $params{server} && safeurl($params{server})) {
|
||||
push @{$metaheaders{$page}}, '<link href="'.encode_entities($params{server}).
|
||||
'" rel="openid.server" />';
|
||||
}
|
||||
push @{$metaheaders{$page}}, '<link href="'.encode_entities($value).
|
||||
'" rel="openid.delegate" />';
|
||||
if (safeurl($value)) {
|
||||
push @{$metaheaders{$page}}, '<link href="'.encode_entities($value).
|
||||
'" rel="openid.delegate" />';
|
||||
}
|
||||
}
|
||||
elsif ($key eq 'redir') {
|
||||
return "" if $page ne $destpage;
|
||||
|
|
|
@ -11,6 +11,7 @@ ikiwiki (2.40) UNRELEASED; urgency=low
|
|||
|
||||
ikiwiki (2.31.3) unstable; urgency=high
|
||||
|
||||
[ Josh Triplett ]
|
||||
* Do not allow the about: URI scheme; some browsers interpret about:
|
||||
URIs like a limited version of data: URIs. In particular, some
|
||||
versions of Internet Explorer interpret arbitrary HTML content in
|
||||
|
@ -18,6 +19,10 @@ ikiwiki (2.31.3) unstable; urgency=high
|
|||
* Also filter the attributes cite, longdesc, and usemap, which can contain
|
||||
URIs.
|
||||
|
||||
[ Joey Hess ]
|
||||
* meta: Check that the urls provided for authorurl, permalink, and openid
|
||||
are safe and can't contain javascript.
|
||||
|
||||
-- Josh Triplett <josh@freedesktop.org> Sun, 10 Feb 2008 13:59:00 -0800
|
||||
|
||||
ikiwiki (2.31.2) unstable; urgency=high
|
||||
|
|
Loading…
Reference in New Issue