From 7d14065baa6c51346e0ec0253c06ac822f082278 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak <alec@alec.pl> Date: Fri, 06 May 2016 02:30:17 -0400 Subject: [PATCH] Fix XSS issue in href attribute on area tag (#5240, #5241) --- tests/Framework/Washtml.php | 17 +++++++++++++++++ 1 files changed, 17 insertions(+), 0 deletions(-) diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php index 9515f0d..2e68179 100644 --- a/tests/Framework/Washtml.php +++ b/tests/Framework/Washtml.php @@ -38,6 +38,23 @@ } /** + * Test XSS in area's href (#5240) + */ + function test_href_area() + { + $html = '<p><area href="data:text/html,<script>alert(document.cookie)</script>">' + . '<area href="vbscript:alert(document.cookie)">Internet Explorer</p>' + . '<area href="javascript:alert(document.domain)" shape=default>'; + + $washer = new rcube_washtml; + $washed = $washer->wash($html); + + $this->assertNotRegExp('/data:text/', $washed, "data:text/html in area href"); + $this->assertNotRegExp('/vbscript:/', $washed, "vbscript: in area href"); + $this->assertNotRegExp('/javascript:/', $washed, "javascript: in area href"); + } + + /** * Test handling HTML comments */ function test_comments() -- Gitblit v1.9.1