Commit 540351dc authored by catch's avatar catch
Browse files

Issue #3511566 by prudloff, smustgrave: Remove srcdoc attributes in Xss::filter() 

(cherry picked from commit 26caa6b1)
parent 849b9483

core/lib/Drupal/Component/Utility/Xss.php

+1 −1
Original line number Diff line number Diff line
@@ -216,7 +216,7 @@ protected static function attributes($attributes) { 
          if (preg_match('/^([-a-zA-Z][-a-zA-Z0-9]*)/', $attributes, $match)) {

            $attribute_name = strtolower($match[1]);

            $skip = (

              $attribute_name == 'style' ||

              in_array($attribute_name, ['style', 'srcdoc']) ||

              str_starts_with($attribute_name, 'on') ||

              str_starts_with($attribute_name, '-') ||

              // Ignore long attributes to avoid unnecessary processing

core/tests/Drupal/Tests/Component/Utility/XssTest.php

+6 −0
Original line number Diff line number Diff line
@@ -432,6 +432,12 @@ public static function providerTestFilterXssNotNormalized() { 
        'HTML filter -- invalid UTF-8.',

        ['p'],

      ],

      [

        '<iframe srcdoc="&lt;script&gt;alert(document.cookie)&lt;/script&gt;"></iframe>',

        'srcdoc',

        'HTML filter attributes removal -- srcdoc attribute.',

        ['iframe'],

      ],

    ];

    return $cases;

  }