From: Max Semenik Date: Wed, 8 Nov 2017 01:45:56 +0000 (-0800) Subject: Escape single quotes in attributes X-Git-Tag: 1.31.0-rc.0~1565^2 X-Git-Url: https://git.cyclocoop.org/%7B%24admin_url%7Dmembres/modifier.php?a=commitdiff_plain;h=47416c0a862fbbdb58b5942a3118f220546878da;p=lhc%2Fweb%2Fwiklou.git Escape single quotes in attributes Replaces a long excuse in Html class not to call Sanitizer::encodeAttribute() with a call to it. In anything security related, excuses are a sign that you're doing something wrong:) Change-Id: Icf7f60d8cd6ea757d8f1999d638b82733001f68a --- diff --git a/includes/Html.php b/includes/Html.php index 8fe4dbe513..0988b0549e 100644 --- a/includes/Html.php +++ b/includes/Html.php @@ -544,28 +544,7 @@ class Html { if ( in_array( $key, self::$boolAttribs ) ) { $ret .= " $key=\"\""; } else { - // Apparently we need to entity-encode \n, \r, \t, although the - // spec doesn't mention that. Since we're doing strtr() anyway, - // we may as well not call htmlspecialchars(). - // @todo FIXME: Verify that we actually need to - // escape \n\r\t here, and explain why, exactly. - // We could call Sanitizer::encodeAttribute() for this, but we - // don't because we're stubborn and like our marginal savings on - // byte size from not having to encode unnecessary quotes. - // The only difference between this transform and the one by - // Sanitizer::encodeAttribute() is ' is not encoded. - $map = [ - '&' => '&', - '"' => '"', - '>' => '>', - // '<' allegedly allowed per spec - // but breaks some tools if not escaped. - "<" => '<', - "\n" => ' ', - "\r" => ' ', - "\t" => ' ' - ]; - $ret .= " $key=$quote" . strtr( $value, $map ) . $quote; + $ret .= " $key=$quote" . Sanitizer::encodeAttribute( $value ) . $quote; } } return $ret; diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt index 1204dbd715..9c92da0f2b 100644 --- a/tests/parser/parserTests.txt +++ b/tests/parser/parserTests.txt @@ -4911,7 +4911,7 @@ External links: Free with trailing quotes (T113666) news:'a'b''c''d e !! html/php

News: Stuff here -

news:'a'bcd e +

news:'a'bcd e

!! html/parsoid

News: Stuff here

@@ -5557,8 +5557,8 @@ External link containing a single quote. (T65947) [//foo.org/bar'baz bang] !! html/php -

[1] -

bang +

[1] +

bang

!! html/parsoid

@@ -7973,7 +7973,7 @@ Link containing double-single-quotes '' (T6598) !! wikitext [[Lista d''e paise d''o munno]] !! html/php -

Lista d''e paise d''o munno +

Lista d''e paise d''o munno

!! html/parsoid

Lista d''e paise d''o munno

@@ -8038,9 +8038,9 @@ Link with double quotes in title part (literal) and alternate part (interpreted) [[''Pentecoste''|''Pentecoste'']] !! html/php

File:Denys Savchenko Pentecoste.jpg -

''Pentecoste'' -

Pentecoste -

Pentecoste +

''Pentecoste'' +

Pentecoste +

Pentecoste

!! html/parsoid

@@ -8333,7 +8333,7 @@ language=kaa !! wikitext [[Something]]'nice !! html -

Something'nice +

Something'nice

!! end @@ -15817,7 +15817,7 @@ Link to category !! wikitext [[:Category:MediaWiki User's Guide]] !! html -

Category:MediaWiki User's Guide +

Category:MediaWiki User's Guide

!! end @@ -16794,7 +16794,7 @@ section 5

text & text[edit]

section 3

-

text ' text[edit]

+

text ' text[edit]

section 4

text " text[edit]

@@ -29427,7 +29427,7 @@ wgFragmentMode=[ 'html5', 'legacy' ]
  • 3 Тест
  • 4 Тест
  • 5 тест
    • -
  • 6 Hey < # " > % : '
    • +
  • 6 Hey < # " > % : '
    • @@ -29436,8 +29436,8 @@ wgFragmentMode=[ 'html5', 'legacy' ]

    Тест[edit]

    Тест[edit]

    тест[edit]

    -

    Hey < # " > % : '[edit]

    -

    #Foo bar #foo Bar #Тест #тест #Hey < # " > % : ' +

    Hey < # " > % : '[edit]

    +

    #Foo bar #foo Bar #Тест #тест #Hey < # " > % : '

    💩

    #啤酒 #啤酒

    @@ -29483,7 +29483,7 @@ wgFragmentMode=[ 'legacy', 'html5' ]

    Тест[edit]

    Тест[edit]

    тест[edit]

    -

    Hey < # " > % : '[edit]

    +

    Hey < # " > % : '[edit]

    #Foo bar #foo Bar #Тест #тест #Hey < # " > % : '

    .F0.9F.92.A9

    #啤酒 #啤酒 @@ -29521,7 +29521,7 @@ wgFragmentMode=[ 'html5' ]

  • 3 Тест
  • 4 Тест
  • 5 тест
    • -
  • 6 Hey < # " > % : '
    • +
  • 6 Hey < # " > % : '
    • @@ -29530,8 +29530,8 @@ wgFragmentMode=[ 'html5' ]

    Тест[edit]

    Тест[edit]

    тест[edit]

    -

    Hey < # " > % : '[edit]

    -

    #Foo bar #foo Bar #Тест #тест #Hey < # " > % : ' +

    Hey < # " > % : '[edit]

    +

    #Foo bar #foo Bar #Тест #тест #Hey < # " > % : '

    💩

    #啤酒 #啤酒