From d095022c601539258940a1774a477c20becd5b0f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 19 May 2012 11:47:27 -0700
Subject: Filter out all style attributes - we don't want them.  Further fix
 for #1849.

---
 system/libraries/Input.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/system/libraries/Input.php b/system/libraries/Input.php
index 2bef3ff4..fa984a88 100644
--- a/system/libraries/Input.php
+++ b/system/libraries/Input.php
@@ -356,10 +356,10 @@ class Input_Core {
 			$data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $data);
 			$data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $data);
 
-			// Only works in IE: <span style="width: expression(alert('Ping!'));"></span>
-			$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i', '$1>', $data);
-			$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i', '$1>', $data);
-			$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu', '$1>', $data);
+                        //remove any style attributes, IE allows too much stupid things in them, eg.
+                        //<span style="width: expression(alert('Ping!'));"></span>
+                        // and in general you really don't want style declarations in your UGC
+                        $data = preg_replace('#(<[^>]+[\x00-\x20\"\'\/])style[^>]*>#iUu', "$1>", $data);
 
 			// Remove namespaced elements (we do not need them)
 			$data = preg_replace('#</*\w+:\w[^>]*+>#i', '', $data);
-- 
cgit v1.2.3