Merge branch '4.6' into main

ibexa · Aug 20, 2024 · 309b847 · 309b847
2 parents c5d18f3 + 369f36f
commit 309b847
Show file tree

Hide file tree

Showing 4 changed files with 63 additions and 6 deletions.
diff --git a/src/bundle/Resources/public/js/CKEditor/core/base-ckeditor.js b/src/bundle/Resources/public/js/CKEditor/core/base-ckeditor.js
@@ -125,7 +125,15 @@ const VIEWPORT_TOP_OFFSET_DISTRACTION_FREE_MODE = 0;
             const wrapper = this.getHTMLDocumentFragment(container.closest('.ibexa-data-source').querySelector('textarea').value);
             const section = wrapper.childNodes[0];
             const { toolbar, extraPlugins = [], extraConfig = {} } = window.ibexa.richText.CKEditor;
-            const locale = new Intl.Locale(doc.querySelector('meta[name="LanguageCode"]').content);
+            let locale;
+            try {
+                locale = new Intl.Locale(doc.querySelector('meta[name="LanguageCode"]').content);
+            } catch (e) {
+                console.warn(
+                    `Unsupported LanguageCode '${doc.querySelector('meta[name="LanguageCode"]').content}' - using fallback 'eng-GB'.`,
+                );
+                locale = new Intl.Locale('eng-GB');
+            }
             const blockCustomStyles = Object.entries(ibexa.richText.customStyles)
                 .filter(([, customStyleConfig]) => !customStyleConfig.inline)
                 .map(([customStyleName, customStyleConfig]) => {

diff --git a/src/bundle/Resources/richtext/schemas/docbook/docbook.iso.sch b/src/bundle/Resources/richtext/schemas/docbook/docbook.iso.sch
@@ -249,8 +249,24 @@
     </s:rule>
   </s:pattern>
   <s:pattern name="Element contents validation">
+    <s:let name="upperCase" value="'ABCDEFGHIJKLMNOPQRSTUVWXYZ'"/>
+    <s:let name="lowerCase" value="'abcdefghijklmnopqrstuvwxyz'"/>
     <s:rule context="db:link">
-      <s:assert test="not(contains(@*[name()='xlink:href'], 'javascript:') or contains(@*[name()='xlink:href'], 'vbscript:'))" mode="schematron-get-full-path-2">using scripts in links is not allowed</s:assert>
+      <!-- Using translate() because we don't have XPath 2, so we can't use lower-case(). -->
+      <s:assert test="starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'http://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'https://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'mailto:') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezcontent://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezlocation://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezremote://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezurl://') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '/') or
+                      starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '#')"
+                mode="schematron-get-full-path-2">links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, ezremote://, ezurl://, /, #</s:assert>
+      <s:assert test="not(contains(@*[name()='xlink:href'], '&lt;') or
+                          contains(@*[name()='xlink:href'], '&gt;') or
+                          contains(@*[name()='xlink:href'], '&quot;'))"
+                mode="schematron-get-full-path-2">using characters [&lt; &gt; &quot;] in links is not allowed</s:assert>
     </s:rule>
   </s:pattern>
 </s:schema>
diff --git a/src/bundle/Resources/richtext/schemas/docbook/docbook.iso.sch.xsl b/src/bundle/Resources/richtext/schemas/docbook/docbook.iso.sch.xsl
@@ -73,10 +73,13 @@
 <axsl:choose><axsl:when test="not(.//db:ezlink)"/><axsl:otherwise><svrl:failed-assert xmlns:svrl="http://purl.oclc.org/dsdl/svrl" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:schold="http://www.ascc.net/xml/schematron" test="not(.//db:ezlink)"><axsl:attribute name="location"><axsl:apply-templates select="." mode="schematron-get-full-path"/></axsl:attribute><svrl:text>ezlink must not occur in the descendants of link</svrl:text></svrl:failed-assert></axsl:otherwise></axsl:choose><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M2"/></axsl:template><axsl:template match="text()" priority="-1" mode="M2"/><axsl:template match="@*|node()" priority="-2" mode="M2"><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M2"/></axsl:template>
 
 <!--PATTERN -->
-
+<axsl:variable name="upperCase" select="'ABCDEFGHIJKLMNOPQRSTUVWXYZ'"/><axsl:variable name="lowerCase" select="'abcdefghijklmnopqrstuvwxyz'"/>
 
 	<!--RULE -->
 <axsl:template match="db:link" priority="1000" mode="M3"><svrl:fired-rule xmlns:svrl="http://purl.oclc.org/dsdl/svrl" context="db:link"/>
 
 		<!--ASSERT -->
-<axsl:choose><axsl:when test="not(contains(@*[name()='xlink:href'], 'javascript:') or contains(@*[name()='xlink:href'], 'vbscript:'))"/><axsl:otherwise><svrl:failed-assert xmlns:svrl="http://purl.oclc.org/dsdl/svrl" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:schold="http://www.ascc.net/xml/schematron" test="not(contains(@*[name()='xlink:href'], 'javascript:') or contains(@*[name()='xlink:href'], 'vbscript:'))"><axsl:attribute name="location"><axsl:apply-templates select="." mode="schematron-get-full-path-2"/></axsl:attribute><svrl:text>using scripts in links is not allowed</svrl:text></svrl:failed-assert></axsl:otherwise></axsl:choose><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M3"/></axsl:template><axsl:template match="text()" priority="-1" mode="M3"/><axsl:template match="@*|node()" priority="-2" mode="M3"><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M3"/></axsl:template></axsl:stylesheet>
+<axsl:choose><axsl:when test="starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'http://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'https://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'mailto:') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezcontent://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezlocation://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezremote://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezurl://') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '/') or                       starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '#')"/><axsl:otherwise><svrl:failed-assert xmlns:svrl="http://purl.oclc.org/dsdl/svrl" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:schold="http://www.ascc.net/xml/schematron" test="starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'http://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'https://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'mailto:') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezcontent://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezlocation://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezremote://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), 'ezurl://') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '/') or starts-with(translate(@*[name()='xlink:href'], $upperCase, $lowerCase), '#')"><axsl:attribute name="location"><axsl:apply-templates select="." mode="schematron-get-full-path-2"/></axsl:attribute><svrl:text>links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, ezremote://, ezurl://, /, #</svrl:text></svrl:failed-assert></axsl:otherwise></axsl:choose>
+
+		<!--ASSERT -->
+<axsl:choose><axsl:when test="not(contains(@*[name()='xlink:href'], '&lt;') or                           contains(@*[name()='xlink:href'], '&gt;') or                           contains(@*[name()='xlink:href'], '&quot;'))"/><axsl:otherwise><svrl:failed-assert xmlns:svrl="http://purl.oclc.org/dsdl/svrl" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:schold="http://www.ascc.net/xml/schematron" test="not(contains(@*[name()='xlink:href'], '&lt;') or contains(@*[name()='xlink:href'], '&gt;') or contains(@*[name()='xlink:href'], '&quot;'))"><axsl:attribute name="location"><axsl:apply-templates select="." mode="schematron-get-full-path-2"/></axsl:attribute><svrl:text>using characters [&lt; &gt; "] in links is not allowed</svrl:text></svrl:failed-assert></axsl:otherwise></axsl:choose><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M3"/></axsl:template><axsl:template match="text()" priority="-1" mode="M3"/><axsl:template match="@*|node()" priority="-2" mode="M3"><axsl:apply-templates select="*|comment()|processing-instruction()" mode="M3"/></axsl:template></axsl:stylesheet>
diff --git a/tests/lib/FieldType/RichTextTest.php b/tests/lib/FieldType/RichTextTest.php
@@ -229,7 +229,37 @@ public function providerForTestValidate()
                 [
                     new ValidationError(
                         "Validation of XML content failed:\n" .
-                        '/section/para/link: using scripts in links is not allowed',
+                        '/section/para/link: links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, ezremote://, ezurl://, /, #',
+                        null,
+                        [],
+                        'xml'
+                    ),
+                ],
+            ],
+            [
+                '<?xml version="1.0" encoding="UTF-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:ezxhtml="http://ez.no/xmlns/ezpublish/docbook/xhtml" xmlns:ezcustom="http://ez.no/xmlns/ezpublish/docbook/custom" version="5.0-variant ezpublish-1.0">
+  <para><link xlink:href="jAvAsCriPt:alert(\'XSS\');">link</link></para>
+</section>',
+                [
+                    new ValidationError(
+                        "Validation of XML content failed:\n" .
+                        '/section/para/link: links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, ezremote://, ezurl://, /, #',
+                        null,
+                        [],
+                        'xml'
+                    ),
+                ],
+            ],
+            [
+                '<?xml version="1.0" encoding="UTF-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:ezxhtml="http://ez.no/xmlns/ezpublish/docbook/xhtml" xmlns:ezcustom="http://ez.no/xmlns/ezpublish/docbook/custom" version="5.0-variant ezpublish-1.0">
+  <para><link xlink:href="https://example.com/foo&lt;bar">link</link></para>
+</section>',
+                [
+                    new ValidationError(
+                        "Validation of XML content failed:\n" .
+                        '/section/para/link: using characters [< > "] in links is not allowed',
                         null,
                         [],
                         'xml'
@@ -244,7 +274,7 @@ public function providerForTestValidate()
                 [
                     new ValidationError(
                         "Validation of XML content failed:\n" .
-                        '/section/para/link: using scripts in links is not allowed',
+                        '/section/para/link: links must start with one of: http://, https://, mailto:, ezcontent://, ezlocation://, ezremote://, ezurl://, /, #',
                         null,
                         [],
                         'xml'