diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2011-08-16 15:17:49 -0700 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2011-08-16 15:24:48 -0700 |
| commit | 586a944ddd4d03e66dea1093306147594748037a (patch) | |
| tree | d98522a5455f5cde0a4e7f852e0569a92657bcd0 | |
| parent | 8a39f411dc3c806422785b1f4d5c7c9d58e4bf85 (diff) | |
| download | rails-586a944ddd4d03e66dea1093306147594748037a.tar.gz rails-586a944ddd4d03e66dea1093306147594748037a.tar.bz2 rails-586a944ddd4d03e66dea1093306147594748037a.zip | |
Tags with invalid names should also be stripped in order to prevent
XSS attacks. Thanks Sascha Depold for the report.
| -rw-r--r-- | actionpack/lib/action_controller/vendor/html-scanner/html/node.rb | 2 | ||||
| -rw-r--r-- | actionpack/test/template/html-scanner/sanitizer_test.rb | 7 |
2 files changed, 8 insertions, 1 deletions
diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb index 22b3243104..4e1f016431 100644 --- a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb +++ b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb @@ -156,7 +156,7 @@ module HTML #:nodoc: end closing = ( scanner.scan(/\//) ? :close : nil ) - return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/) + return Text.new(parent, line, pos, content) unless name = scanner.scan(/[^\s!>\/]+/) name.downcase! unless closing diff --git a/actionpack/test/template/html-scanner/sanitizer_test.rb b/actionpack/test/template/html-scanner/sanitizer_test.rb index 678cb9eeeb..62ad6be680 100644 --- a/actionpack/test/template/html-scanner/sanitizer_test.rb +++ b/actionpack/test/template/html-scanner/sanitizer_test.rb @@ -5,6 +5,13 @@ class SanitizerTest < ActionController::TestCase @sanitizer = nil # used by assert_sanitizer end + def test_strip_tags_with_quote + sanitizer = HTML::FullSanitizer.new + string = '<" <img src="trollface.gif" onload="alert(1)"> hi' + + assert_equal ' hi', sanitizer.sanitize(string) + end + def test_strip_tags sanitizer = HTML::FullSanitizer.new assert_equal("<<<bad html", sanitizer.sanitize("<<<bad html")) |