View | Details | Raw Unified | Return to bug 39860
Collapse All | Expand All

(-)a/C4/Scrubber.pm (-4 / +62 lines)
Lines 27-39 use HTML::Scrubber; Link Here
27
use C4::Context;
27
use C4::Context;
28
28
29
my %scrubbertypes = (
29
my %scrubbertypes = (
30
    default => {},    # place holder, default settings are below as fallbacks in call to constructor
30
    default        => {},    # place holder, default settings are below as fallbacks in call to constructor
31
    comment => { allow => [qw( br b i em big small strong )], },
31
    comment        => { allow => [qw( br b i em big small strong )], },
32
    note    => { allow => [qw[ br b i em big small strong u hr span div p ]] },
32
    note           => { allow => [qw[ br b i em big small strong u hr span div p ]] },
33
    record_display => {
34
        deny => [
35
            qw( script noscript style iframe frame frameset noframes object embed applet meta link base head title body html canvas audio video source track)
36
        ],
37
        default => [ 1 => { '*' => 1 } ],
38
        rules   => [
39
            '*' => {
40
41
                # Scrub all of the "on" event handlers in attributes
42
                onclick       => 0,
43
                ondblclick    => 0,
44
                onmousedown   => 0,
45
                onmouseup     => 0,
46
                onmouseover   => 0,
47
                onmousemove   => 0,
48
                onmouseout    => 0,
49
                onkeypress    => 0,
50
                onkeydown     => 0,
51
                onkeyup       => 0,
52
                onload        => 0,
53
                onunload      => 0,
54
                onfocus       => 0,
55
                onblur        => 0,
56
                onchange      => 0,
57
                onselect      => 0,
58
                onsubmit      => 0,
59
                onreset       => 0,
60
                onresize      => 0,
61
                onscroll      => 0,
62
                onerror       => 0,
63
                onabort       => 0,
64
                ondragstart   => 0,
65
                ondrag        => 0,
66
                ondragend     => 0,
67
                ondrop        => 0,
68
                ondragover    => 0,
69
                ondragenter   => 0,
70
                ondragleave   => 0,
71
                oncontextmenu => 0,
72
                onwheel       => 0,
73
                ontouchstart  => 0,
74
                ontouchend    => 0,
75
                ontouchmove   => 0,
76
                ontouchcancel => 0,
77
78
                #Scrub formaction
79
                formaction => 0,
80
81
                # Block dangerous URLs in href/src
82
                href => qr{^(?!javascript:|data:(?!image/)|vbscript:|file:|about:)}i,
83
                src  => qr{^(?!javascript:|data:(?!image/)|vbscript:|file:|about:)}i,
84
85
                # Block dangerous XML/XLink attributes
86
                'xmlns:xlink' => 0,
87
                'xlink:href'  => 0,
88
            },
89
        ],
90
    },
33
);
91
);
34
92
35
sub new {
93
sub new {
36
    shift;            # ignore our class we are wrapper
94
    shift;    # ignore our class we are wrapper
37
    my $type = (@_) ? shift : 'default';
95
    my $type = (@_) ? shift : 'default';
38
    if ( !exists $scrubbertypes{$type} ) {
96
    if ( !exists $scrubbertypes{$type} ) {
39
        croak "New called with unrecognized type '$type'";
97
        croak "New called with unrecognized type '$type'";
(-)a/C4/XSLT.pm (-2 / +1 lines)
Lines 277-283 sub XSLTParse4Display { Link Here
277
    }
277
    }
278
278
279
    if ($extracontent) {
279
    if ($extracontent) {
280
        my $scrubber               = C4::Scrubber->new('staff');
280
        my $scrubber               = C4::Scrubber->new('record_display');
281
        my $extracontentproccessed = process_tt( $extracontent, { record => $record } );
281
        my $extracontentproccessed = process_tt( $extracontent, { record => $record } );
282
        $extracontent = $scrubber->scrub($extracontentproccessed);
282
        $extracontent = $scrubber->scrub($extracontentproccessed);
283
    }
283
    }
284
- 

Return to bug 39860