More XSS stuff

narfbg · narfbg · commit 249580e711d4 · 2015-10-02T16:44:05.000+03:00
diff --git a/system/core/Security.php b/system/core/Security.php
@@ -808,7 +808,7 @@ protected function _sanitize_naughty_html($matches)
 				.'([\s\042\047/=]*)' // non-attribute characters, excluding > (tag close) for obvious reasons
 				.'(?<name>[^\s\042\047>/=]+)' // attribute characters
 				// optional attribute-value
-				.'(?:\s*=\s*\042[^\042]+\042|\s*=\s*\047[^\047]+\047|\s*=\s*[^\s\042\047=><`]*)?' // attribute-value separator
+				.'(?:\s*=(?:[^\s\042\047=><`]+|\s*\042[^\042]+\042|\s*\047[^\047]+\047|\s*(?U:[^\s\042\047=><`]*)))' // attribute-value separator
 				.'#i';
 
 			if ($count = preg_match_all($pattern, $matches['attributes'], $attributes, PREG_SET_ORDER | PREG_OFFSET_CAPTURE))
diff --git a/tests/codeigniter/core/Security_test.php b/tests/codeigniter/core/Security_test.php
@@ -162,7 +162,7 @@ public function test_xss_clean_sanitize_naughty_html_attributes()
 	{
 		$this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo onAttribute="bar">'));
 		$this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo onAttributeNoQuotes=bar>'));
-		$this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo onAttributeWithSpaces = bar>'));
+		$this->assertEquals('<foo [removed]bar>', $this->security->xss_clean('<foo onAttributeWithSpaces = bar>'));
 		$this->assertEquals('<foo prefixOnAttribute="bar">', $this->security->xss_clean('<foo prefixOnAttribute="bar">'));
 		$this->assertEquals('<foo>onOutsideOfTag=test</foo>', $this->security->xss_clean('<foo>onOutsideOfTag=test</foo>'));
 		$this->assertEquals('onNoTagAtAll = true', $this->security->xss_clean('onNoTagAtAll = true'));
@@ -207,6 +207,11 @@ public function test_xss_clean_sanitize_naughty_html_attributes()
 			'<image src="<>" [removed]>',
 			$this->security->xss_clean('<image src="<>" onerror=\'alert(1)\'>')
 		);
+
+		$this->assertEquals(
+			'<b "=<=  [removed]>',
+			$this->security->xss_clean('<b "=<= onmouseover=alert(1)>')
+		);
 	}
 
 	// --------------------------------------------------------------------
