Changeset 52304 for trunk/src/wp-includes/kses.php

Timestamp:

12/02/2021 12:54:03 AM (4 years ago)

Author:

peterwilsoncc

Message:

KSES: Allow attributes to be restricted via callbacks.

Add callback validation to HTML tag attributes for increased flexibility over an array of values only.

In object tags, validate the data attribute via a callback to ensure it is a PDF and matches the type attribute. This prevents mime type mismatches in browsers.

Follow up to [51963].

Props Pento, dd32, swissspidy, xknown, peterwilsoncc.
Fixes #54261.

File:

• trunk/src/wp-includes/kses.php (modified) (3 diffs)

trunk/src/wp-includes/kses.php

@@ -273 +273 @@
         ),
         'object'     => array(
-            'data' => true,
+            'data' => array(
+                'required'       => true,
+                'value_callback' => '_wp_kses_allow_pdf_objects',
+            ),
             'type' => array(
                 'required' => true,
@@ -1662 +1665 @@
             }
             break;
+
+        case 'value_callback':
+            /*
+             * The value_callback check is used when you want to make sure that the attribute
+             * value is accepted by the callback function.
+             */
+
+            if ( ! call_user_func( $checkvalue, $value ) ) {
+                $ok = false;
+            }
+            break;
     } // End switch.
 
@@ -2567 +2581 @@
     return $value;
 }
+
+/**
+ * Helper function to check if this is a safe PDF URL.
+ *
+ * @since 5.9.0
+ * @access private
+ * @ignore
+ *
+ * @param string $url The URL to check.
+ * @return bool True if the URL is safe, false otherwise.
+ */
+function _wp_kses_allow_pdf_objects( $value ) {
+    // We're not interested in URLs that contain query strings or fragments.
+    if ( strpos( $value, '?' ) !== false || strpos( $value, '#' ) !== false ) {
+        return false;
+    }
+
+    // If it doesn't have a PDF extension, it's not safe.
+    if ( 0 !== substr_compare( $value, '.pdf', -4, 4, true ) ) {
+        return false;
+    }
+
+    // If the URL host matches the current site's media URL, it's safe.
+    $upload_info = wp_upload_dir( null, false );
+    $upload_host = wp_parse_url( $upload_info['url'], PHP_URL_HOST );
+    if ( 0 === strpos( $value, "http://$upload_host/" ) || 0 === strpos( $value, "https://$upload_host/" ) ) {
+        return true;
+    }
+
+    return false;
+}