diff --git a/data/class/SC_Initial.php b/data/class/SC_Initial.php index 26230c5ab0..1f72909a3d 100644 --- a/data/class/SC_Initial.php +++ b/data/class/SC_Initial.php @@ -35,7 +35,7 @@ class SC_Initial public function __construct() { /** EC-CUBEのバージョン */ - define('ECCUBE_VERSION', '2.17.2-p1'); + define('ECCUBE_VERSION', '2.17.2-p2'); } /** diff --git a/data/smarty_extends/modifier.script_escape.php b/data/smarty_extends/modifier.script_escape.php index 92e7ee1bf1..0e04180830 100644 --- a/data/smarty_extends/modifier.script_escape.php +++ b/data/smarty_extends/modifier.script_escape.php @@ -9,12 +9,36 @@ function smarty_modifier_script_escape($value) { if (is_array($value)) return $value; - $pattern = "/|<\/script>|javascript:|||||||<.*onmouse.*?>|(\"|').*(onmouse|onerror|onload|onclick).*=.*(\"|').*/i"; + $pattern = "|<\/script>|javascript:|||||||"; + + // 追加でサニタイズするイベント一覧 + $escapeEvents = array( + 'onmouse', + 'onclick', + 'onblur', + 'onfocus', + 'onresize', + 'onscroll', + 'ondblclick', + 'onchange', + 'onselect', + 'onsubmit', + 'onkey', + ); + + // イベント毎の正規表現を生成 + $generateHtmlTagPatterns = array_map(function($str) { + return "<(\w+)([^>]*\s)?\/?".$str."[^>]*>"; + }, $escapeEvents); + $pattern .= implode("|", $generateHtmlTagPatterns)."|"; + $pattern .= "(\"|').*(onerror|onload|".implode("|", $escapeEvents).").*=.*(\"|').*"; + + // 正規表現をまとめる + $attributesPattern = "/${pattern}/i"; + + // 置き換える文字列 $convert = '#script tag escaped#'; - if (preg_match_all($pattern, $value, $matches)) { - return preg_replace($pattern, $convert, $value); - } else { - return $value; - } + // マッチしたら文字列を置き換える + return preg_replace($attributesPattern, $convert, $value); } diff --git a/tests/class/modifier/Modifier_ScriptEscapeTest.php b/tests/class/modifier/Modifier_ScriptEscapeTest.php new file mode 100644 index 0000000000..4d32d460ad --- /dev/null +++ b/tests/class/modifier/Modifier_ScriptEscapeTest.php @@ -0,0 +1,74 @@ +'), + array('test'), + array('test'), + array('test'), + array(''), + array(''), + array(''), + array('\"onclick=\"alert(1)\"'), + array('

test

'), + array('

test

'), + array('

test

'), + array(''), + array(''), + array(''), + array(''), + array('
'), + array('
javascript:test()
'), + array(''), + array(''), + array(''), + array('
'), + array(''), + array(''), + array(''), + array(''), + array('
'), + ); + } + + public function scriptNoEscapeProvider() + { + return array( + array('

test

'), + array(''), + array('

onclick

'), + array('
test
'), + array(''), + array('

onclick="\ntest();"

'), + array('assertRegExp($pattern, $ret); + } + + /** + * @dataProvider scriptNoEscapeProvider + */ + public function testメールテンプレート_エスケープされない($value) + { + $ret = smarty_modifier_script_escape($value); + $pattern = "/#script tag escaped#/"; + $this->assertNotRegExp($pattern, $ret); + } +}