Changeset 46907

Timestamp:

12/12/2019 06:36:20 PM (5 years ago)

Author:

whyisjake

Message:

Ensure that a user can publish_posts before making a post sticky.
Props: danielbachhuber, whyisjake, peterwilson, xknown.
Prevent stored XSS through wp_targeted_link_rel().
Props: vortfu, whyisjake, peterwilsoncc, xknown, SergeyBiryukov, flaviozavan.
Update wp_kses_bad_protocol() to recognize : on uri attributes,
wp_kses_bad_protocol() makes sure to validate that uri attributes don't contain invalid/or not allowed protocols. While this works fine in most cases, there's a risk that by using the colon html5 named entity, one is able to bypass this function.
Brings r46895 to the 5.3 branch.
Props: xknown, nickdaugherty, peterwilsoncc.
Prevent stored XSS in the block editor.
Brings r46896 to the 5.3 branch.
Prevent escaped unicode characters become unescaped in unsafe HTML during JSON decoding.
Props: aduth, epiqueras.

Location:

branches/5.1

Files:

• . (modified) (1 prop)
• src/wp-includes/blocks.php (modified) (3 diffs)
• src/wp-includes/default-filters.php (modified) (1 diff)
• src/wp-includes/formatting.php (modified) (4 diffs)
• src/wp-includes/kses.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (3 diffs)
• tests/phpunit/tests/blocks/block-type.php (modified) (1 diff)
• tests/phpunit/tests/blocks/filter.php (added)
• tests/phpunit/tests/blocks/serialization.php (added)
• tests/phpunit/tests/formatting/WPTargetedLinkRel.php (modified) (3 diffs)
• tests/phpunit/tests/kses.php (modified) (1 diff)

branches/5.1/src/wp-includes/blocks.php

@@ -75 +75 @@
  * @see parse_blocks()
  *
- * @param string                  $block_type Full Block type to look for.
+ * @param string                  $block_name Full Block type to look for.
  * @param int|string|WP_Post|null $post Optional. Post content, post ID, or post object. Defaults to global $post.
  * @return bool Whether the post content contains the specified block.
  */
-function has_block( $block_type, $post = null ) {
+function has_block( $block_name, $post = null ) {
     if ( ! has_blocks( $post ) ) {
         return false;
@@ -91 +91 @@
     }
 
-    return false !== strpos( $post, '<!-- wp:' . $block_type . ' ' );
+    /*
+     * Normalize block name to include namespace, if provided as non-namespaced.
+     * This matches behavior for WordPress 5.0.0 - 5.3.0 in matching blocks by
+     * their serialized names.
+     */
+    if ( false === strpos( $block_name, '/' ) ) {
+        $block_name = 'core/' . $block_name;
+    }
+
+    // Test for existence of block by its fully qualified name.
+    $has_block = false !== strpos( $post, '<!-- wp:' . $block_name . ' ' );
+
+    if ( ! $has_block ) {
+        /*
+         * If the given block name would serialize to a different name, test for
+         * existence by the serialized form.
+         */
+        $serialized_block_name = strip_core_block_namespace( $block_name );
+        if ( $serialized_block_name !== $block_name ) {
+            $has_block = false !== strpos( $post, '<!-- wp:' . $serialized_block_name . ' ' );
+        }
+    }
+
+    return $has_block;
 }
 
@@ -112 +135 @@
 
     return $dynamic_block_names;
+}
+
+/**
+ * Given an array of attributes, returns a string in the serialized attributes
+ * format prepared for post content.
+ *
+ * The serialized result is a JSON-encoded string, with unicode escape sequence
+ * substitution for characters which might otherwise interfere with embedding
+ * the result in an HTML comment.
+ *
+ * @since 5.3.1
+ *
+ * @param array $attributes Attributes object.
+ * @return string Serialized attributes.
+ */
+function serialize_block_attributes( $block_attributes ) {
+    $encoded_attributes = json_encode( $block_attributes );
+    $encoded_attributes = preg_replace( '/--/', '\\u002d\\u002d', $encoded_attributes );
+    $encoded_attributes = preg_replace( '/</', '\\u003c', $encoded_attributes );
+    $encoded_attributes = preg_replace( '/>/', '\\u003e', $encoded_attributes );
+    $encoded_attributes = preg_replace( '/&/', '\\u0026', $encoded_attributes );
+    // Regex: /\\"/
+    $encoded_attributes = preg_replace( '/\\\\"/', '\\u0022', $encoded_attributes );
+
+    return $encoded_attributes;
+}
+
+/**
+ * Returns the block name to use for serialization. This will remove the default
+ * "core/" namespace from a block name.
+ *
+ * @since 5.3.1
+ *
+ * @param string $block_name Original block name.
+ * @return string Block name to use for serialization.
+ */
+function strip_core_block_namespace( $block_name = null ) {
+    if ( is_string( $block_name ) && 0 === strpos( $block_name, 'core/' ) ) {
+        return substr( $block_name, 5 );
+    }
+
+    return $block_name;
+}
+
+/**
+ * Returns the content of a block, including comment delimiters.
+ *
+ * @since 5.3.1
+ *
+ * @param string $block_name Block name.
+ * @param array  $attributes Block attributes.
+ * @param string $content    Block save content.
+ * @return string Comment-delimited block content.
+ */
+function get_comment_delimited_block_content( $block_name = null, $block_attributes, $block_content ) {
+    if ( is_null( $block_name ) ) {
+        return $block_content;
+    }
+
+    $serialized_block_name = strip_core_block_namespace( $block_name );
+    $serialized_attributes = empty( $block_attributes ) ? '' : serialize_block_attributes( $block_attributes ) . ' ';
+
+    if ( empty( $block_content ) ) {
+        return sprintf( '<!-- wp:%s %s/-->', $serialized_block_name, $serialized_attributes );
+    }
+
+    return sprintf(
+        '<!-- wp:%s %s-->%s<!-- /wp:%s -->',
+        $serialized_block_name,
+        $serialized_attributes,
+        $block_content,
+        $serialized_block_name
+    );
+}
+
+/**
+ * Returns the content of a block, including comment delimiters, serializing all
+ * attributes from the given parsed block.
+ *
+ * This should be used when preparing a block to be saved to post content.
+ * Prefer `render_block` when preparing a block for display. Unlike
+ * `render_block`, this does not evaluate a block's `render_callback`, and will
+ * instead preserve the markup as parsed.
+ *
+ * @since 5.3.1
+ *
+ * @param WP_Block_Parser_Block $block A single parsed block object.
+ * @return string String of rendered HTML.
+ */
+function serialize_block( $block ) {
+    $block_content = '';
+
+    $index = 0;
+    foreach ( $block['innerContent'] as $chunk ) {
+        $block_content .= is_string( $chunk ) ? $chunk : serialize_block( $block['innerBlocks'][ $index++ ] );
+    }
+
+    if ( ! is_array( $block['attrs'] ) ) {
+        $block['attrs'] = array();
+    }
+
+    return get_comment_delimited_block_content(
+        $block['blockName'],
+        $block['attrs'],
+        $block_content
+    );
+}
+
+/**
+ * Returns a joined string of the aggregate serialization of the given parsed
+ * blocks.
+ *
+ * @since 5.3.1
+ *
+ * @param WP_Block_Parser_Block[] $blocks Parsed block objects.
+ * @return string String of rendered HTML.
+ */
+function serialize_blocks( $blocks ) {
+    return implode( '', array_map( 'serialize_block', $blocks ) );
+}
+
+/**
+ * Filters and sanitizes block content to remove non-allowable HTML from
+ * parsed block attribute values.
+ *
+ * @since 5.3.1
+ *
+ * @param string         $text              Text that may contain block content.
+ * @param array[]|string $allowed_html      An array of allowed HTML elements
+ *                                          and attributes, or a context name
+ *                                          such as 'post'.
+ * @param string[]       $allowed_protocols Array of allowed URL protocols.
+ * @return string The filtered and sanitized content result.
+ */
+function filter_block_content( $text, $allowed_html = 'post', $allowed_protocols = array() ) {
+    $result = '';
+
+    $blocks = parse_blocks( $text );
+    foreach ( $blocks as $block ) {
+        $block   = filter_block_kses( $block, $allowed_html, $allowed_protocols );
+        $result .= serialize_block( $block );
+    }
+
+    return $result;
+}
+
+/**
+ * Filters and sanitizes a parsed block to remove non-allowable HTML from block
+ * attribute values.
+ *
+ * @since 5.3.1
+ *
+ * @param WP_Block_Parser_Block $block             The parsed block object.
+ * @param array[]|string        $allowed_html      An array of allowed HTML
+ *                                                 elements and attributes, or a
+ *                                                 context name such as 'post'.
+ * @param string[]              $allowed_protocols Allowed URL protocols.
+ * @return array The filtered and sanitized block object result.
+ */
+function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() ) {
+    $block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols );
+
+    if ( is_array( $block['innerBlocks'] ) ) {
+        foreach ( $block['innerBlocks'] as $i => $inner_block ) {
+            $block['innerBlocks'][ $i ] = filter_block_kses( $inner_block, $allowed_html, $allowed_protocols );
+        }
+    }
+
+    return $block;
+}
+
+/**
+ * Filters and sanitizes a parsed block attribute value to remove non-allowable
+ * HTML.
+ *
+ * @since 5.3.1
+ *
+ * @param mixed          $value             The attribute value to filter.
+ * @param array[]|string $allowed_html      An array of allowed HTML elements
+ *                                          and attributes, or a context name
+ *                                          such as 'post'.
+ * @param string[]       $allowed_protocols Array of allowed URL protocols.
+ * @return array The filtered and sanitized result.
+ */
+function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array() ) {
+    if ( is_array( $value ) ) {
+        foreach ( $value as $key => $inner_value ) {
+            $filtered_key   = filter_block_kses_value( $key, $allowed_html, $allowed_protocols );
+            $filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols );
+
+            if ( $filtered_key !== $key ) {
+                unset( $value[ $key ] );
+            }
+
+            $value[ $filtered_key ] = $filtered_value;
+        }
+    } elseif ( is_string( $value ) ) {
+        return wp_kses( $value, $allowed_html, $allowed_protocols );
+    }
+
+    return $value;
 }
 

branches/5.1/src/wp-includes/default-filters.php

@@ -246 +246 @@
 add_filter( 'teeny_mce_before_init', '_mce_set_direction' );
 add_filter( 'pre_kses', 'wp_pre_kses_less_than' );
+add_filter( 'pre_kses', 'wp_pre_kses_block_attributes', 10, 3 );
 add_filter( 'sanitize_title', 'sanitize_title_with_dashes', 10, 3 );
 add_action( 'check_comment_flood', 'check_comment_flood_db', 10, 4 );

branches/5.1/src/wp-includes/formatting.php

@@ -3042 +3042 @@
 function wp_targeted_link_rel( $text ) {
     // Don't run (more expensive) regex if no links with targets.
-    if ( stripos( $text, 'target' ) !== false && stripos( $text, '<a ' ) !== false ) {
-        $text = preg_replace_callback( '|<a\s([^>]*target\s*=[^>]*)>|i', 'wp_targeted_link_rel_callback', $text );
+    if ( stripos( $text, 'target' ) === false || stripos( $text, '<a ' ) === false || is_serialized( $text ) ) {
+        return $text;
+    }
+
+    $script_and_style_regex = '/<(script|style).*?<\/\\1>/si';
+
+    preg_match_all( $script_and_style_regex, $text, $matches );
+    $extra_parts = $matches[0];
+    $html_parts  = preg_split( $script_and_style_regex, $text );
+
+    foreach ( $html_parts as &$part ) {
+        $part = preg_replace_callback( '|<a\s([^>]*target\s*=[^>]*)>|i', 'wp_targeted_link_rel_callback', $part );
+    }
+
+    $text = '';
+    for ( $i = 0; $i < count( $html_parts ); $i++ ) {
+        $text .= $html_parts[ $i ];
+        if ( isset( $extra_parts[ $i ] ) ) {
+            $text .= $extra_parts[ $i ];
+        }
     }
 
@@ -3059 +3077 @@
  */
 function wp_targeted_link_rel_callback( $matches ) {
-    $link_html = $matches[1];
-    $rel_match = array();
+    $link_html          = $matches[1];
+    $original_link_html = $link_html;
+
+    // Consider the html escaped if there are no unescaped quotes
+    $is_escaped = ! preg_match( '/(^|[^\\\\])[\'"]/', $link_html );
+    if ( $is_escaped ) {
+        // Replace only the quotes so that they are parsable by wp_kses_hair, leave the rest as is
+        $link_html = preg_replace( '/\\\\([\'"])/', '$1', $link_html );
+    }
+
+    $atts = wp_kses_hair( $link_html, wp_allowed_protocols() );
 
     /**
@@ -3072 +3099 @@
     $rel = apply_filters( 'wp_targeted_link_rel', 'noopener noreferrer', $link_html );
 
-    // Avoid additional regex if the filter removes rel values.
-    if ( ! $rel ) {
-        return "<a $link_html>";
-    }
-
-    // Value with delimiters, spaces around are optional.
-    $attr_regex = '|rel\s*=\s*?(\\\\{0,1}["\'])(.*?)\\1|i';
-    preg_match( $attr_regex, $link_html, $rel_match );
-
-    if ( empty( $rel_match[0] ) ) {
-        // No delimiters, try with a single value and spaces, because `rel =  va"lue` is totally fine...
-        $attr_regex = '|rel\s*=(\s*)([^\s]*)|i';
-        preg_match( $attr_regex, $link_html, $rel_match );
-    }
-
-    if ( ! empty( $rel_match[0] ) ) {
-        $parts     = preg_split( '|\s+|', strtolower( $rel_match[2] ) );
-        $parts     = array_map( 'esc_attr', $parts );
-        $needed    = explode( ' ', $rel );
-        $parts     = array_unique( array_merge( $parts, $needed ) );
-        $delimiter = trim( $rel_match[1] ) ? $rel_match[1] : '"';
-        $rel       = 'rel=' . $delimiter . trim( implode( ' ', $parts ) ) . $delimiter;
-        $link_html = str_replace( $rel_match[0], $rel, $link_html );
-    } else {
-        $link_html .= " rel=\"$rel\"";
+    // Return early if no rel values to be added or if no actual target attribute
+    if ( ! $rel || ! isset( $atts['target'] ) ) {
+        return "<a $original_link_html>";
+    }
+
+    if ( isset( $atts['rel'] ) ) {
+        $all_parts = preg_split( '/\s/', "{$atts['rel']['value']} $rel", -1, PREG_SPLIT_NO_EMPTY );
+        $rel       = implode( ' ', array_unique( $all_parts ) );
+    }
+
+    $atts['rel']['whole'] = 'rel="' . esc_attr( $rel ) . '"';
+    $link_html            = join( ' ', array_column( $atts, 'whole' ) );
+
+    if ( $is_escaped ) {
+        $link_html = preg_replace( '/[\'"]/', '\\\\$0', $link_html );
     }
 
@@ -4798 +4815 @@
 
 /**
+ * Remove non-allowable HTML from parsed block attribute values when filtering
+ * in the post context.
+ *
+ * @since 5.3.1
+ *
+ * @param string         $string            Content to be run through KSES.
+ * @param array[]|string $allowed_html      An array of allowed HTML elements
+ *                                          and attributes, or a context name
+ *                                          such as 'post'.
+ * @param string[]       $allowed_protocols Array of allowed URL protocols.
+ * @return string Filtered text to run through KSES.
+ */
+function wp_pre_kses_block_attributes( $string, $allowed_html, $allowed_protocols ) {
+    /*
+     * `filter_block_content` is expected to call `wp_kses`. Temporarily remove
+     * the filter to avoid recursion.
+     */
+    remove_filter( 'pre_kses', 'wp_pre_kses_block_attributes', 10 );
+    $string = filter_block_content( $string, $allowed_html, $allowed_protocols );
+    add_filter( 'pre_kses', 'wp_pre_kses_block_attributes', 10, 3 );
+
+    return $string;
+}
+
+/**
  * WordPress implementation of PHP sprintf() with filters.
  *

branches/5.1/src/wp-includes/kses.php

@@ -1659 +1659 @@
 function wp_kses_bad_protocol_once( $string, $allowed_protocols, $count = 1 ) {
     $string  = preg_replace( '/(&#0*58(?![;0-9])|&#x0*3a(?![;a-f0-9]))/i', '$1;', $string );
-    $string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );
+    $string2 = preg_split( '/:|&#0*58;|&#x0*3a;|:/i', $string, 2 );
     if ( isset( $string2[1] ) && ! preg_match( '%/\?%', $string2[0] ) ) {
         $string   = trim( $string2[1] );

branches/5.1/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -500 +500 @@
         }
 
-        if ( ! empty( $request['sticky'] ) && ! current_user_can( $post_type->cap->edit_others_posts ) ) {
+        if ( ! empty( $request['sticky'] ) && ! current_user_can( $post_type->cap->edit_others_posts ) && ! current_user_can( $post_type->cap->publish_posts ) ) {
             return new WP_Error( 'rest_cannot_assign_sticky', __( 'Sorry, you are not allowed to make posts sticky.' ), array( 'status' => rest_authorization_required_code() ) );
         }
@@ -655 +655 @@
         }
 
-        if ( ! empty( $request['sticky'] ) && ! current_user_can( $post_type->cap->edit_others_posts ) ) {
+        if ( ! empty( $request['sticky'] ) && ! current_user_can( $post_type->cap->edit_others_posts ) && ! current_user_can( $post_type->cap->publish_posts ) ) {
             return new WP_Error( 'rest_cannot_assign_sticky', __( 'Sorry, you are not allowed to make posts sticky.' ), array( 'status' => rest_authorization_required_code() ) );
         }
@@ -957 +957 @@
      */
     protected function prepare_item_for_database( $request ) {
-        $prepared_post = new stdClass;
+        $prepared_post = new stdClass();
 
         // Post ID.

branches/5.1/tests/phpunit/tests/blocks/block-type.php

@@ -303 +303 @@
         // even if it detects a proper $post global it should still be false for a missing block.
         $this->assertFalse( has_block( 'core/fake' ) );
+    }
+
+    public function test_post_has_block_serialized_name() {
+        $content = '<!-- wp:serialized /--><!-- wp:core/normalized /--><!-- wp:plugin/third-party /-->';
+
+        $this->assertTrue( has_block( 'core/serialized', $content ) );
+
+        /*
+         * Technically, `has_block` should receive a "full" (normalized, parsed)
+         * block name. But this test conforms to expected pre-5.3.1 behavior.
+         */
+        $this->assertTrue( has_block( 'serialized', $content ) );
+        $this->assertTrue( has_block( 'core/normalized', $content ) );
+        $this->assertTrue( has_block( 'normalized', $content ) );
+        $this->assertFalse( has_block( 'plugin/normalized', $content ) );
+        $this->assertFalse( has_block( 'plugin/serialized', $content ) );
+        $this->assertFalse( has_block( 'third-party', $content ) );
+        $this->assertFalse( has_block( 'core/third-party', $content ) );
     }
 

branches/5.1/tests/phpunit/tests/formatting/WPTargetedLinkRel.php

@@ -39 +39 @@
     public function test_rel_with_single_quote_delimiter() {
         $content  = '<p>Links: <a href="/" rel=\'existing values\' target="_blank">Existing rel</a></p>';
-        $expected = '<p>Links: <a href="/" rel=\'existing values noopener noreferrer\' target="_blank">Existing rel</a></p>';
+        $expected = '<p>Links: <a href="/" rel="existing values noopener noreferrer" target="_blank">Existing rel</a></p>';
         $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
     }
@@ -52 +52 @@
         $content  = '<p>Links: <a href="/" rel = existing target="_blank">Existing rel</a></p>';
         $expected = '<p>Links: <a href="/" rel="existing noopener noreferrer" target="_blank">Existing rel</a></p>';
-        $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
-    }
-
-    public function test_rel_value_spaced_and_no_delimiter_and_values_to_escape() {
-        $content  = '<p>Links: <a href="/" rel = existing"value target="_blank">Existing rel</a></p>';
-        $expected = '<p>Links: <a href="/" rel="existing&quot;value noopener noreferrer" target="_blank">Existing rel</a></p>';
         $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
     }
@@ -102 +96 @@
         $this->assertEquals( $expected, $post->post_content );
     }
+
+    /**
+     * Ensure JSON format is preserved when relation attribute (rel) is missing.
+     *
+     * @ticket 46316
+     */
+    public function test_wp_targeted_link_rel_should_preserve_json() {
+        $content  = '<p>Links: <a href=\"\/\" target=\"_blank\">No rel<\/a><\/p>';
+        $expected = '<p>Links: <a href=\"\/\" target=\"_blank\" rel=\"noopener noreferrer\">No rel<\/a><\/p>';
+        $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
+    }
+
+    /**
+     * Ensure the content of style and script tags are not processed
+     *
+     * @ticket 47244
+     */
+    public function test_wp_targeted_link_rel_skips_style_and_scripts() {
+        $content  = '<style><a href="/" target=a></style><p>Links: <script>console.log("<a href=\'/\' target=a>hi</a>");</script><script>alert(1);</script>here <a href="/" target=_blank>aq</a></p><script>console.log("<a href=\'last\' target=\'_blank\'")</script>';
+        $expected = '<style><a href="/" target=a></style><p>Links: <script>console.log("<a href=\'/\' target=a>hi</a>");</script><script>alert(1);</script>here <a href="/" target="_blank" rel="noopener noreferrer">aq</a></p><script>console.log("<a href=\'last\' target=\'_blank\'")</script>';
+        $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
+    }
+
+    /**
+     * Ensure entirely serialized content is ignored.
+     *
+     * @ticket 46402
+     */
+    public function test_ignore_entirely_serialized_content() {
+        $content  = 'a:1:{s:4:"html";s:52:"<p>Links: <a href="/" target="_blank">No Rel</a></p>";}';
+        $expected = 'a:1:{s:4:"html";s:52:"<p>Links: <a href="/" target="_blank">No Rel</a></p>";}';
+        $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
+    }
+
+    public function test_wp_targeted_link_rel_tab_separated_values_are_split() {
+        $content  = "<p>Links: <a href=\"/\" target=\"_blank\" rel=\"ugc\t\tnoopener\t\">No rel</a></p>";
+        $expected = '<p>Links: <a href="/" target="_blank" rel="ugc noopener noreferrer">No rel</a></p>';
+        $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
+    }
+
 }

branches/5.1/tests/phpunit/tests/kses.php

@@ -179 +179 @@
         }
 
+        $bad_not_normalized = array(
+            'dummy:alert(1)',
+            'javascript:alert(1)',
+            'javascript&CoLon;alert(1)',
+            'javascript:alert(1);',
+            'javascript:alert(1);',
+            'javascript:alert(1);',
+            'javascript&#0000058alert(1);',
+            'jav    ascript:alert(1);',
+            'javascript:javascript:alert(1);',
+            'javascript:javascript:alert(1);',
+            'javascript&#0000058javascript:alert(1);',
+            'javascript:javascript&#0000058alert(1);',
+            'javascript&#58alert(1)',
+        );
+        foreach ( $bad_not_normalized as $k => $x ) {
+            $result = wp_kses_bad_protocol( $x, wp_allowed_protocols() );
+            if ( ! empty( $result ) && 'alert(1);' !== $result && 'alert(1)' !== $result ) {
+                $this->fail( "wp_kses_bad_protocol failed on $k, $x. Result: $result" );
+            }
+        }
+
         $safe = array(
             'dummy:alert(1)',