CVE-2023-5323: Fix #hunter7a048bb7-bfdd-4299-931e-9bc283e92bc8 · Dolibarr/dolibarr@695ca08

Expand Up

@@ -173,16 +173,20 @@ function testSqlAndScriptInject($val, $type)

$inj += preg_match('/on(lostpointercapture|offline|online|pagehide|pageshow)\s*=/i’, $val);

$inj += preg_match('/on(paste|pause|play|playing|progress|ratechange|reset|resize|scroll|search|seeked|seeking|show|stalled|start|submit|suspend)\s*=/i’, $val);

$inj += preg_match('/on(timeupdate|toggle|unload|volumechange|waiting|wheel)\s*=/i’, $val);

// More not into the previous list

$inj += preg_match('/on(repeat|begin|finish|beforeinput)\s*=/i’, $val);

// We refuse html into html because some hacks try to obfuscate evil strings by inserting HTML into HTML. Example: <img on<a>error=alert(1) to bypass test on onerror

$tmpval = preg_replace('/<[^<]+>/’, '’, $val);

// List of dom events is on https://www.w3schools.com/jsref/dom_obj_event.asp and https://developer.mozilla.org/en-US/docs/Web/API/GlobalEventHandlers

$inj += preg_match(‘/on(mouse|drag|key|load|touch|pointer|select|transition)([a-z]*)\s*=/i’, $val); // onmousexxx can be set on img or any html tag like <img title=’…’ onmouseover=alert(1)>

$inj += preg_match(‘/on(mouse|drag|key|load|touch|pointer|select|transition)([a-z]*)\s*=/i’, $tmpval); // onmousexxx can be set on img or any html tag like <img title=’…’ onmouseover=alert(1)>

$inj += preg_match('/on(abort|afterprint|animation|auxclick|beforecopy|beforecut|beforeprint|beforeunload|blur|cancel|canplay|canplaythrough|change|click|close|contextmenu|cuechange|copy|cut)\s*=/i’, $tmpval);

$inj += preg_match('/on(dblclick|drop|durationchange|emptied|end|ended|error|focus|focusin|focusout|formdata|gotpointercapture|hashchange|input|invalid)\s*=/i’, $tmpval);

$inj += preg_match('/on(lostpointercapture|offline|online|pagehide|pageshow)\s*=/i’, $tmpval);

$inj += preg_match('/on(paste|pause|play|playing|progress|ratechange|reset|resize|scroll|search|seeked|seeking|show|stalled|start|submit|suspend)\s*=/i’, $tmpval);

$inj += preg_match('/on(timeupdate|toggle|unload|volumechange|waiting|wheel)\s*=/i’, $tmpval);

// More not into the previous list

$inj += preg_match('/on(repeat|begin|finish|beforeinput)\s*=/i’, $tmpval);

//$inj += preg_match('/on[A-Z][a-z]+\*=/’, $val); // To lock event handlers onAbort(), …

$inj += preg_match('/:|&#0000058|&#x3A/i’, $val); // refused string ‘:’ encoded (no reason to have it encoded) to lock ‘javascript:…’

Expand Down