From 544470baf1267c718672de01adaa38cc11897906 Mon Sep 17 00:00:00 2001 From: Lucas Gass Date: Fri, 6 Jun 2025 17:31:46 +0000 Subject: [PATCH] Bug 39860: Add record_display srubber profile --- C4/Scrubber.pm | 66 +++++++++++++++++++++++++++++++++++++++++++++++--- C4/XSLT.pm | 2 +- 2 files changed, 63 insertions(+), 5 deletions(-) diff --git a/C4/Scrubber.pm b/C4/Scrubber.pm index f5201418e74..9e13f951a80 100644 --- a/C4/Scrubber.pm +++ b/C4/Scrubber.pm @@ -27,13 +27,71 @@ use HTML::Scrubber; use C4::Context; my %scrubbertypes = ( - default => {}, # place holder, default settings are below as fallbacks in call to constructor - comment => { allow => [qw( br b i em big small strong )], }, - note => { allow => [qw[ br b i em big small strong u hr span div p ]] }, + default => {}, # place holder, default settings are below as fallbacks in call to constructor + comment => { allow => [qw( br b i em big small strong )], }, + note => { allow => [qw[ br b i em big small strong u hr span div p ]] }, + record_display => { + deny => [ + qw( script noscript style iframe frame frameset noframes object embed applet meta link base head title body html canvas audio video source track) + ], + default => [ 1 => { '*' => 1 } ], + rules => [ + '*' => { + + # Scrub all of the "on" event handlers in attributes + onclick => 0, + ondblclick => 0, + onmousedown => 0, + onmouseup => 0, + onmouseover => 0, + onmousemove => 0, + onmouseout => 0, + onkeypress => 0, + onkeydown => 0, + onkeyup => 0, + onload => 0, + onunload => 0, + onfocus => 0, + onblur => 0, + onchange => 0, + onselect => 0, + onsubmit => 0, + onreset => 0, + onresize => 0, + onscroll => 0, + onerror => 0, + onabort => 0, + ondragstart => 0, + ondrag => 0, + ondragend => 0, + ondrop => 0, + ondragover => 0, + ondragenter => 0, + ondragleave => 0, + oncontextmenu => 0, + onwheel => 0, + ontouchstart => 0, + ontouchend => 0, + ontouchmove => 0, + ontouchcancel => 0, + + #Scrub formaction + formaction => 0, + + # Block dangerous URLs in href/src + href => qr{^(?!javascript:|data:(?!image/)|vbscript:|file:|about:)}i, + src => qr{^(?!javascript:|data:(?!image/)|vbscript:|file:|about:)}i, + + # Block dangerous XML/XLink attributes + 'xmlns:xlink' => 0, + 'xlink:href' => 0, + }, + ], + }, ); sub new { - shift; # ignore our class we are wrapper + shift; # ignore our class we are wrapper my $type = (@_) ? shift : 'default'; if ( !exists $scrubbertypes{$type} ) { croak "New called with unrecognized type '$type'"; diff --git a/C4/XSLT.pm b/C4/XSLT.pm index 0479ee91002..d2179e617f4 100644 --- a/C4/XSLT.pm +++ b/C4/XSLT.pm @@ -277,7 +277,7 @@ sub XSLTParse4Display { } if ($extracontent) { - my $scrubber = C4::Scrubber->new('staff'); + my $scrubber = C4::Scrubber->new('record_display'); my $extracontentproccessed = process_tt( $extracontent, { record => $record } ); $extracontent = $scrubber->scrub($extracontentproccessed); } -- 2.39.5