Merge branch '2.3' into 4.6

ibexa · Aug 14, 2024 · b2fc7fe · b2fc7fe
2 parents 4b30d2f + 6131975
commit b2fc7fe
Show file tree

Hide file tree

Showing 3 changed files with 51 additions and 5 deletions.
diff --git a/src/bundle/Resources/richtext/schemas/docbook/docbook.iso.sch b/src/bundle/Resources/richtext/schemas/docbook/docbook.iso.sch
@@ -249,8 +249,21 @@
     </s:rule>
   </s:pattern>
   <s:pattern name="Element contents validation">
+    <s:let name="upperCase" value="'ABCDEFGHIJKLMNOPQRSTUVWXYZ'"/>
+    <s:let name="lowerCase" value="'abcdefghijklmnopqrstuvwxyz'"/>
     <s:rule context="db:link">
-      <s:assert test="not(contains(@*[name()='xlink:href'], 'javascript:') or contains(@*[name()='xlink:href'], 'vbscript:'))" mode="schematron-get-full-path-2">using scripts in links is not allowed</s:assert>
+      <!-- Using translate() because we don't have XPath 2, so we can't use lower-case(). -->
+      <s:assert test="starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'http://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'https://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'mailto:') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezcontent://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezlocation://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '#')"
+                mode="schematron-get-full-path-2">links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, #</s:assert>
+      <s:assert test="not(contains(@*[name()='xlink:href'], '&lt;') or
+                          contains(@*[name()='xlink:href'], '&gt;') or
+                          contains(@*[name()='xlink:href'], '&quot;'))"
+                mode="schematron-get-full-path-2">using characters [&lt; &gt; &quot;] in links is not allowed</s:assert>
     </s:rule>
   </s:pattern>
 </s:schema>
diff --git a/src/bundle/Resources/richtext/schemas/docbook/docbook.iso.sch.xsl b/src/bundle/Resources/richtext/schemas/docbook/docbook.iso.sch.xsl
@@ -73,10 +73,13 @@
 <axsl:choose><axsl:when test="not(.//db:ezlink)"/><axsl:otherwise><svrl:failed-assert xmlns:svrl="http://purl.oclc.org/dsdl/svrl" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:schold="http://www.ascc.net/xml/schematron" test="not(.//db:ezlink)"><axsl:attribute name="location"><axsl:apply-templates select="." mode="schematron-get-full-path"/></axsl:attribute><svrl:text>ezlink must not occur in the descendants of link</svrl:text></svrl:failed-assert></axsl:otherwise></axsl:choose><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M2"/></axsl:template><axsl:template match="text()" priority="-1" mode="M2"/><axsl:template match="@*|node()" priority="-2" mode="M2"><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M2"/></axsl:template>
 
 <!--PATTERN -->
-
+<axsl:variable name="upperCase" select="'ABCDEFGHIJKLMNOPQRSTUVWXYZ'"/><axsl:variable name="lowerCase" select="'abcdefghijklmnopqrstuvwxyz'"/>
 
 	<!--RULE -->
 <axsl:template match="db:link" priority="1000" mode="M3"><svrl:fired-rule xmlns:svrl="http://purl.oclc.org/dsdl/svrl" context="db:link"/>
 
 		<!--ASSERT -->
-<axsl:choose><axsl:when test="not(contains(@*[name()='xlink:href'], 'javascript:') or contains(@*[name()='xlink:href'], 'vbscript:'))"/><axsl:otherwise><svrl:failed-assert xmlns:svrl="http://purl.oclc.org/dsdl/svrl" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:schold="http://www.ascc.net/xml/schematron" test="not(contains(@*[name()='xlink:href'], 'javascript:') or contains(@*[name()='xlink:href'], 'vbscript:'))"><axsl:attribute name="location"><axsl:apply-templates select="." mode="schematron-get-full-path-2"/></axsl:attribute><svrl:text>using scripts in links is not allowed</svrl:text></svrl:failed-assert></axsl:otherwise></axsl:choose><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M3"/></axsl:template><axsl:template match="text()" priority="-1" mode="M3"/><axsl:template match="@*|node()" priority="-2" mode="M3"><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M3"/></axsl:template></axsl:stylesheet>
+<axsl:choose><axsl:when test="starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'http://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'https://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'mailto:') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezcontent://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezlocation://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '#')"/><axsl:otherwise><svrl:failed-assert xmlns:svrl="http://purl.oclc.org/dsdl/svrl" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:schold="http://www.ascc.net/xml/schematron" test="starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'http://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'https://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'mailto:') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezcontent://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezlocation://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '#')"><axsl:attribute name="location"><axsl:apply-templates select="." mode="schematron-get-full-path-2"/></axsl:attribute><svrl:text>links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, #</svrl:text></svrl:failed-assert></axsl:otherwise></axsl:choose>
+
+		<!--ASSERT -->
+<axsl:choose><axsl:when test="not(contains(@*[name()='xlink:href'], '&lt;') or                           contains(@*[name()='xlink:href'], '&gt;') or                           contains(@*[name()='xlink:href'], '&quot;'))"/><axsl:otherwise><svrl:failed-assert xmlns:svrl="http://purl.oclc.org/dsdl/svrl" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:schold="http://www.ascc.net/xml/schematron" test="not(contains(@*[name()='xlink:href'], '&lt;') or contains(@*[name()='xlink:href'], '&gt;') or contains(@*[name()='xlink:href'], '&quot;'))"><axsl:attribute name="location"><axsl:apply-templates select="." mode="schematron-get-full-path-2"/></axsl:attribute><svrl:text>using characters [&lt; &gt; "] in links is not allowed</svrl:text></svrl:failed-assert></axsl:otherwise></axsl:choose><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M3"/></axsl:template><axsl:template match="text()" priority="-1" mode="M3"/><axsl:template match="@*|node()" priority="-2" mode="M3"><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M3"/></axsl:template></axsl:stylesheet>
diff --git a/tests/lib/FieldType/RichTextTest.php b/tests/lib/FieldType/RichTextTest.php
@@ -229,7 +229,37 @@ public function providerForTestValidate()
                 [
                     new ValidationError(
                         "Validation of XML content failed:\n" .
-                        '/section/para/link: using scripts in links is not allowed',
+                        '/section/para/link: links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, #',
+                        null,
+                        [],
+                        'xml'
+                    ),
+                ],
+            ],
+            [
+                '<?xml version="1.0" encoding="UTF-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:ezxhtml="http://ez.no/xmlns/ezpublish/docbook/xhtml" xmlns:ezcustom="http://ez.no/xmlns/ezpublish/docbook/custom" version="5.0-variant ezpublish-1.0">
+  <para><link xlink:href="jAvAsCriPt:alert(\'XSS\');">link</link></para>
+</section>',
+                [
+                    new ValidationError(
+                        "Validation of XML content failed:\n" .
+                        '/section/para/link: links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, #',
+                        null,
+                        [],
+                        'xml'
+                    ),
+                ],
+            ],
+            [
+                '<?xml version="1.0" encoding="UTF-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:ezxhtml="http://ez.no/xmlns/ezpublish/docbook/xhtml" xmlns:ezcustom="http://ez.no/xmlns/ezpublish/docbook/custom" version="5.0-variant ezpublish-1.0">
+  <para><link xlink:href="https://example.com/foo&lt;bar">link</link></para>
+</section>',
+                [
+                    new ValidationError(
+                        "Validation of XML content failed:\n" .
+                        '/section/para/link: using characters [< > "] in links is not allowed',
                         null,
                         [],
                         'xml'
@@ -244,7 +274,7 @@ public function providerForTestValidate()
                 [
                     new ValidationError(
                         "Validation of XML content failed:\n" .
-                        '/section/para/link: using scripts in links is not allowed',
+                        '/section/para/link: links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, #',
                         null,
                         [],
                         'xml'