gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Quotes should also be escaped

Browse Source 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
This commit is contained in:
Kamil Tekiela 2023-12-01 18:05:25 +01:00
parent a2f13a8cd2
commit d610f1aece
2 changed files with 6 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/Sanitize.php
View File

@ -13,7 +13,6 @@ use function __;
use function array_keys;
use function array_merge;
use function count;
use function htmlspecialchars;
use function in_array;
use function is_string;
use function json_encode;
@ -153,16 +152,7 @@ class Sanitize
}
/**
* Sanitizes $message, taking into account our special codes
* for formatting.
*
* If you want to include result in element attribute, you should escape it.
*
* Examples:
*
* <p><?php echo Sanitize::sanitizeMessage($foo); ?></p>
*
* <a title="<?php echo Sanitize::sanitizeMessage($foo, true); ?>">bar</a>
* Sanitizes $message, taking into account our special codes for formatting.
*
* @param string $message the message
* @param bool $safe whether string is safe (can keep < and > chars)
@ -170,7 +160,7 @@ class Sanitize
public static function sanitizeMessage(string $message, bool $safe = false): string
{
if (! $safe) {
$message = strtr($message, ['<' => '&lt;', '>' => '&gt;']);
$message = strtr($message, ['<' => '&lt;', '>' => '&gt;', '"' => '&quot;', "'" => '&#039;']);
}
/**

8
tests/classes/SanitizeTest.php
View File

@ -28,7 +28,7 @@ class SanitizeTest extends AbstractTestCase
public function testXssInHref(): void
{
$this->assertEquals(
'[a@javascript:alert(\'XSS\');@target]link</a>',
'[a@javascript:alert(&#039;XSS&#039;);@target]link</a>',
Sanitize::sanitizeMessage('[a@javascript:alert(\'XSS\');@target]link[/a]'),
);
}
@ -98,7 +98,7 @@ class SanitizeTest extends AbstractTestCase
public function testLinkDocXss(): void
{
$this->assertEquals(
'[a@./Documentation.html" onmouseover="alert(foo)"]doc</a>',
'[a@./Documentation.html&quot; onmouseover=&quot;alert(foo)&quot;]doc</a>',
Sanitize::sanitizeMessage('[a@./Documentation.html" onmouseover="alert(foo)"]doc[/a]'),
);
}
@ -110,7 +110,7 @@ class SanitizeTest extends AbstractTestCase
{
$this->assertEquals(
'<a href="index.php?route=/url&url=https%3A%2F%2Fdocs.phpmyadmin.net%2F">doc</a>'
. '[a@javascript:alert(\'XSS\');@target]link</a>',
. '[a@javascript:alert(&#039;XSS&#039;);@target]link</a>',
Sanitize::sanitizeMessage(
'[a@https://docs.phpmyadmin.net/]doc[/a][a@javascript:alert(\'XSS\');@target]link[/a]',
),
@ -123,7 +123,7 @@ class SanitizeTest extends AbstractTestCase
public function testHtmlTags(): void
{
$this->assertEquals(
'&lt;div onclick=""&gt;',
'&lt;div onclick=&quot;&quot;&gt;',
Sanitize::sanitizeMessage('<div onclick="">'),
);
}