File tree Expand file tree Collapse file tree 2 files changed +7
-2
lines changed
lib/internal/Magento/Framework/Filter Expand file tree Collapse file tree 2 files changed +7
-2
lines changed Original file line number Diff line number Diff line change @@ -30,7 +30,9 @@ class MaliciousCode implements \Zend_Filter_Interface
3030 '/(ondblclick|onclick|onkeydown|onkeypress|onkeyup|onmousedown|onmousemove|onmouseout|onmouseover|onmouseup| ' .
3131 'onload|onunload|onerror)=[^<]*(?=\/*\>)/Uis ' ,
3232 //tags
33- '/<\/?\??(script|meta|link|frame|iframe|object|php).*>/Uis ' ,
33+ '/<\/?\??(script|meta|link|frame|iframe|object).*>/Uis ' ,
34+ //scripts
35+ '/<\/?\??(php).*>/Uis ' ,
3436 //base64 usage
3537 '/src=[^<]*base64[^<]*(?=\/*\>)/Uis ' ,
3638 ];
Original file line number Diff line number Diff line change @@ -112,8 +112,11 @@ public function filterDataProvider()
112112 'Nested malicious tags ' => [
113113 '<scri<script>pt>alert(1);</scri<script>pt> ' ,
114114 'alert(1); ' ,
115+ ],
116+ 'Nested scripts ' => [
115117 '<?php echo "test"?> ' ,
116- ]
118+ '' ,
119+ ],
117120 ];
118121 }
119122
You can’t perform that action at this time.
0 commit comments