From: jenkins-bot Date: Thu, 27 Oct 2016 10:49:57 +0000 (+0000) Subject: Merge "UploadBase: Permit SVG files with broken namespace definition (Inkscape bug)" X-Git-Tag: 1.31.0-rc.0~5019 X-Git-Url: https://git.cyclocoop.org/%242?a=commitdiff_plain;h=9e8cdbbb66dbb607daec04b63327b61448fe43e9;hp=a65a3516055e5fe3e4d44ee1efd84d4754946a58;p=lhc%2Fweb%2Fwiklou.git Merge "UploadBase: Permit SVG files with broken namespace definition (Inkscape bug)" --- diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php index 91b4133c5d..34226323ad 100644 --- a/includes/upload/UploadBase.php +++ b/includes/upload/UploadBase.php @@ -1440,7 +1440,11 @@ abstract class UploadBase { 'http://www.w3.org/tr/rec-rdf-syntax/', ]; - if ( !in_array( $namespace, $validNamespaces ) ) { + // Inkscape mangles namespace definitions created by Adobe Illustrator. + // This is nasty but harmless. (T144827) + $isBuggyInkscape = preg_match( '/^&(#38;)*ns_[a-z_]+;$/', $namespace ); + + if ( !( $isBuggyInkscape || in_array( $namespace, $validNamespaces ) ) ) { wfDebug( __METHOD__ . ": Non-svg namespace '$namespace' in uploaded file.\n" ); /** @todo Return a status object to a closure in XmlTypeCheck, for MW1.21+ */ $this->mSVGNSError = $namespace; diff --git a/tests/phpunit/data/upload/buggynamespace-bad.svg b/tests/phpunit/data/upload/buggynamespace-bad.svg new file mode 100644 index 0000000000..974fac0623 --- /dev/null +++ b/tests/phpunit/data/upload/buggynamespace-bad.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + eJzsvWl3XjXyL3pf91r9HZ50MyQkfrw1awcIZCBAYyAQaEIzBMd+krjx1LYDzf/F+exXNUml/Qwx +d1/++qv/+P2XX3/z1fc//9mvf/jyH796+/Lbc2Z9+eNXvzn/9Pbr77/64cfvvv/q7Ye//+53hNBH ++sFf/MXf/Nv/5ec/+38A7g2BFw== + + + diff --git a/tests/phpunit/data/upload/buggynamespace-evilhtml.svg b/tests/phpunit/data/upload/buggynamespace-evilhtml.svg new file mode 100644 index 0000000000..f4be479ed8 --- /dev/null +++ b/tests/phpunit/data/upload/buggynamespace-evilhtml.svg @@ -0,0 +1,12 @@ + + + +]> + +
foo
 + diff --git a/tests/phpunit/data/upload/buggynamespace-okay.svg b/tests/phpunit/data/upload/buggynamespace-okay.svg new file mode 100644 index 0000000000..4a5c6aae23 --- /dev/null +++ b/tests/phpunit/data/upload/buggynamespace-okay.svg @@ -0,0 +1,52 @@ + + + +image/svg+xml + + + + + + + + + + + + eJzsvWl3XjXyL3pf91r9HZ50MyQkfrw1awcIZCBAYyAQaEIzBMd+krjx1LYDzf/F+exXNUml/Qwx +d1/++qv/+P2XX3/z1fc//9mvf/jyH796+/Lbc2Z9+eNXvzn/9Pbr77/64cfvvv/q7Ye//+53hNBH ++sFf/MXf/Nv/5ec/+38A7g2BFw== + + + \ No newline at end of file diff --git a/tests/phpunit/data/upload/buggynamespace-okay2.svg b/tests/phpunit/data/upload/buggynamespace-okay2.svg new file mode 100644 index 0000000000..fe42310f63 --- /dev/null +++ b/tests/phpunit/data/upload/buggynamespace-okay2.svg @@ -0,0 +1,52 @@ + + + +image/svg+xml + + + + + + + + + + + + eJzsvWl3XjXyL3pf91r9HZ50MyQkfrw1awcIZCBAYyAQaEIzBMd+krjx1LYDzf/F+exXNUml/Qwx +d1/++qv/+P2XX3/z1fc//9mvf/jyH796+/Lbc2Z9+eNXvzn/9Pbr77/64cfvvv/q7Ye//+53hNBH ++sFf/MXf/Nv/5ec/+38A7g2BFw== + + + \ No newline at end of file diff --git a/tests/phpunit/data/upload/buggynamespace-original.svg b/tests/phpunit/data/upload/buggynamespace-original.svg new file mode 100644 index 0000000000..c61c91cfd8 --- /dev/null +++ b/tests/phpunit/data/upload/buggynamespace-original.svg @@ -0,0 +1,33 @@ + + + + + + + + + + +]> + + + + + + + + + + + + + eJzsvWl3XjXyL3pf91r9HZ50MyQkfrw1awcIZCBAYyAQaEIzBMd+krjx1LYDzf/F+exXNUml/Qwx +d1/++qv/+P2XX3/z1fc//9mvf/jyH796+/Lbc2Z9+eNXvzn/9Pbr77/64cfvvv/q7Ye//+53hNBH ++sFf/MXf/Nv/5ec/+38A7g2BFw== + + + diff --git a/tests/phpunit/includes/upload/UploadBaseTest.php b/tests/phpunit/includes/upload/UploadBaseTest.php index 3debe6e198..a44926b208 100644 --- a/tests/phpunit/includes/upload/UploadBaseTest.php +++ b/tests/phpunit/includes/upload/UploadBaseTest.php @@ -397,6 +397,46 @@ class UploadBaseTest extends MediaWikiTestCase { // @codingStandardsIgnoreEnd } + /** + * @dataProvider provideDetectScriptInSvg + */ + public function testDetectScriptInSvg( $svg, $expected, $message ) { + // This only checks some weird cases, most tests are in testCheckSvgScriptCallback() above + $result = $this->upload->detectScriptInSvg( $svg, false ); + $this->assertSame( $expected, $result, $message ); + } + + public static function provideDetectScriptInSvg() { + global $IP; + return [ + [ + "$IP/tests/phpunit/data/upload/buggynamespace-original.svg", + false, + 'SVG with a weird but valid namespace definition created by Adobe Illustrator' + ], + [ + "$IP/tests/phpunit/data/upload/buggynamespace-okay.svg", + false, + 'SVG with a namespace definition created by Adobe Illustrator and mangled by Inkscape' + ], + [ + "$IP/tests/phpunit/data/upload/buggynamespace-okay2.svg", + false, + 'SVG with a namespace definition created by Adobe Illustrator and mangled by Inkscape (twice)' + ], + [ + "$IP/tests/phpunit/data/upload/buggynamespace-bad.svg", + [ 'uploadscriptednamespace', 'i' ], + 'SVG with a namespace definition using an undefined entity' + ], + [ + "$IP/tests/phpunit/data/upload/buggynamespace-evilhtml.svg", + [ 'uploadscriptednamespace', 'http://www.w3.org/1999/xhtml' ], + 'SVG with an html namespace encoded as an entity' + ], + ]; + } + /** * @dataProvider provideCheckXMLEncodingMissmatch */ @@ -442,4 +482,11 @@ class UploadTestHandler extends UploadBase { ); return [ $check->wellFormed, $check->filterMatch ]; } + + /** + * Same as parent function, but override visibility to 'public'. + */ + public function detectScriptInSvg( $filename, $partial ) { + return parent::detectScriptInSvg( $filename, $partial ); + } }