Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Enhance antiXSS by excluding non printable chars used to obfuscate hack

Browse Source
This commit is contained in:
Laurent Destailleur
2020-09-20 04:56:45 +02:00
parent 85aa1ab402
commit 2eb46b4900
3 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/main.inc.php
View File

@@ -57,11 +57,13 @@ if (!empty($_SERVER['MAIN_SHOW_TUNING_INFO']))
*/
function testSqlAndScriptInject($val, $type)
{
$val = html_entity_decode($val, ENT_QUOTES); // So <svg o&#110;load='console.log(&quot;123&quot;)' become <svg onload='console.log(&quot;123&quot;)'
$val = str_replace('%09', '', $val); // 'java%09script' is processed like 'javascript' (whatever is place of %09)
$val = html_entity_decode($val, ENT_QUOTES); // So <svg o&#110;load='console.log(&quot;123&quot;)' become <svg onload='console.log(&quot;123&quot;)'
// TODO loop to decode until no more thing to decode ?
// We clean string because some hacks try to obfuscate evil strings by inserting non printable chars. Example: 'java(ascci09)scr(ascii00)ipt' is processed like 'javascript' (whatever is place of evil ascii char)
$val = preg_replace('/[\x00-\x1F\x7F]/u', '', $val); // We should use dol_string_nounprintableascii but function is not yet loaded/available
//var_dump($val);
$inj = 0;
// For SQL Injection (only GET are used to be included into bad escaped SQL requests)
if ($type == 1 || $type == 3)