fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-04 01:01:41 +09:00
Code Issues Projects Releases Packages Wiki Activity

Fix incorrect generation of whitelist regexp

Browse source
This commit is contained in:
Kijin Sung 2016-01-12 19:23:27 +09:00
parent 2be2e8e73e
commit 5196ddaf83
1 changed files with 7 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

31
classes/security/Purifier.class.php
View file

@ -26,20 +26,17 @@ class Purifier
private function _setConfig()
{
$whiteDomainRegex = $this->_getWhiteDomainRegx();
//$allowdClasses = array('emoticon');
$this->_config = HTMLPurifier_Config::createDefault();
$this->_config->set('HTML.TidyLevel', 'light');
$this->_config->set('Output.FlashCompat', TRUE);
$this->_config->set('HTML.SafeObject', TRUE);
$this->_config->set('HTML.SafeEmbed', TRUE);
$this->_config->set('HTML.SafeIframe', TRUE);
$this->_config->set('URI.SafeIframeRegexp', $whiteDomainRegex);
$this->_config->set('URI.SafeIframeRegexp', $this->_getWhiteDomainRegexp());
$this->_config->set('Cache.SerializerPath', $this->_cacheDir);
$this->_config->set('Attr.AllowedFrameTargets', array('_blank'));
//$allowdClasses = array('emoticon');
//$this->_config->set('Attr.AllowedClasses', $allowdClasses);
$this->_def = $this->_config->getHTMLDefinition(TRUE);
}
@ -135,31 +132,17 @@ class Purifier
return array_unique($attributeList);
}
private function _getWhiteDomainRegx()
private function _getWhiteDomainRegexp()
{
$oEmbedFilter = EmbedFilter::getInstance();
$whiteIframeUrlList = $oEmbedFilter->getWhiteIframeUrlList();
$whiteDomainRegex = '%^https?://(';
$whiteDomainCount = count($whiteIframeUrlList);
$i=1;
if(is_array($whiteIframeUrlList))
$whiteDomains = array();
foreach($whiteIframeUrlList as $domain)
{
foreach($whiteIframeUrlList as $value)
{
$whiteDomainRegex .= $value;
if($i < $whiteDomainCount)
{
$whiteDomainRegex .= '|';
}
$i++;
}
$whiteDomains[] = preg_quote($domain, '%');
}
$whiteDomainRegex .= ')%';
return $whiteDomainRegex;
return '%^https?://(' . implode('|', $whiteDomains) . ')%';
}
private function _checkCacheDir()