diff options
| author | Bharat Mediratta <bharat@menalto.com> | 2012-05-19 11:47:27 -0700 |
|---|---|---|
| committer | Bharat Mediratta <bharat@menalto.com> | 2012-05-19 11:47:27 -0700 |
| commit | d095022c601539258940a1774a477c20becd5b0f (patch) | |
| tree | 614246ef88b6bd34cf3e60fade08a99111c860b0 /system | |
| parent | f89888f46c80deebd5b2fd634cc8b658ff8c0bbf (diff) | |
Filter out all style attributes - we don't want them. Further fix for #1849.
Diffstat (limited to 'system')
| -rw-r--r-- | system/libraries/Input.php | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/system/libraries/Input.php b/system/libraries/Input.php index 2bef3ff4..fa984a88 100644 --- a/system/libraries/Input.php +++ b/system/libraries/Input.php @@ -356,10 +356,10 @@ class Input_Core { $data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $data); $data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $data); - // Only works in IE: <span style="width: expression(alert('Ping!'));"></span> - $data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i', '$1>', $data); - $data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i', '$1>', $data); - $data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu', '$1>', $data); + //remove any style attributes, IE allows too much stupid things in them, eg. + //<span style="width: expression(alert('Ping!'));"></span> + // and in general you really don't want style declarations in your UGC + $data = preg_replace('#(<[^>]+[\x00-\x20\"\'\/])style[^>]*>#iUu', "$1>", $data); // Remove namespaced elements (we do not need them) $data = preg_replace('#</*\w+:\w[^>]*+>#i', '', $data); |