![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
#10226 closed defect (bug) (fixed)
Sanitization bypass in clean_url and wp_sanitise redirect
| Reported by: | westi | Owned by: | westi |
|---|---|---|---|
| Priority: | normal | Milestone: | 2.8.1 |
| Component: | Security | Version: | 2.8 |
| Severity: | normal | Keywords: | |
| Cc: | Focuses: |
Description
Following on from #4819, while writing unit tests for clean_url I noticed an issue with the way in which it removes %0d and %0a from urls.
It expects the miscreant to have been nice and used lower case letters so %0D and %0A just slip straight through.
This also affects wp_safe_redirect and clean_url can currently be bypassed in the same way that wp_safe_redirect could before #4819 is fixed.
Change History (7)
#4
follow-up:
↓ 5
@
17 years ago
- Resolution fixed
- Status closed → reopened
seems like there's a buggy loop, with one or both of:
- %0%0%0DAD
- %0%0%0ADA
#5
in reply to: ↑ 4
@
17 years ago
- Resolution → fixed
- Status reopened → closed
Replying to Denis-de-Bernardy:
seems like there's a buggy loop, with one or both of:
- %0%0%0DAD
- %0%0%0ADA
Nope both of those are covered fine.
Note:
See TracTickets
for help on using tickets.
(In [11615]) Introduce _deep_replace() and use it to improve the stripping of percent encoded values from urls. Fixes #10226 for trunk.