Nemcio/Grav
1
0
Fork 0
mirror of https://github.com/getgrav/grav.git synced 2026-07-11 17:22:11 +02:00
Code Issues Packages Projects Releases Activity

XSS fix for grav-ghsa-cvmr-6428-87w9

Browse Source
This commit is contained in:
Andy Miller
2020-11-30 16:10:56 -07:00
parent 76670e47a1
commit 75b74c4ab3
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
system/src/Grav/Common/Security.php
View File

@@ -133,7 +133,7 @@ class Security
// Set the patterns we'll test against
$patterns = [
// Match any attribute starting with "on" or xmlns
'on_events' => '#(<[^>]+[[a-z\x00-\x20\"\'\/])(\son|\sxmlns)[a-z].*=>?#iUu',
'on_events' => '#(<[^>]+[[a-z\x00-\x20\"\'\/])([\s\/]on|\sxmlns)[a-z].*=>?#iUu',
// Match javascript:, livescript:, vbscript:, mocha:, feed: and data: protocols
'invalid_protocols' => '#(' . implode('|', $invalid_protocols) . '):.*?#iUu',