Merge branch '4.11' into 4.12-release

silverstripe · Nov 21, 2022 · 4c3bd37 · 4c3bd37
2 parents 5cc4105 + 8526067
commit 4c3bd37
Show file tree

Hide file tree

Showing 3 changed files with 82 additions and 0 deletions.
diff --git a/code/Model/SiteTree.php b/code/Model/SiteTree.php
@@ -71,6 +71,7 @@
 use SilverStripe\Versioned\Versioned;
 use SilverStripe\View\ArrayData;
 use SilverStripe\View\HTML;
+use SilverStripe\View\Parsers\HTMLValue;
 use SilverStripe\View\Parsers\ShortcodeParser;
 use SilverStripe\View\Parsers\URLSegmentFilter;
 use SilverStripe\View\Shortcodes\EmbedShortcodeProvider;
@@ -1689,6 +1690,8 @@ protected function onBeforeWrite()
             $this->setNextWriteWithoutVersion(true);
         }
 
+        $this->sanitiseExtraMeta();
+
         // Flush cached [embed] shortcodes
         // Flush on both DRAFT and LIVE because VersionedCacheAdapter has separate caches for both
         // Clear both caches at once for the scenario where a CMS-author updates a remote resource
@@ -1708,6 +1711,27 @@ protected function onBeforeWrite()
         }
     }
 
+    private function sanitiseExtraMeta(): void
+    {
+        $htmlValue = HTMLValue::create($this->ExtraMeta);
+        /** @var DOMElement $el */
+        foreach ($htmlValue->query('//*') as $el) {
+            /** @var DOMAttr $attr */
+            $attributes = $el->attributes;
+            for ($i = count($attributes) - 1; $i >= 0; $i--) {
+                $attr = $attributes->item($i);
+                // remove any attribute starting with 'on' e.g. onclick
+                // and remove the accesskey attribute
+                if (substr($attr->name, 0, 2) === 'on' ||
+                    $attr->name === 'accesskey'
+                ) {
+                    $el->removeAttributeNode($attr);
+                }
+            }
+        }
+        $this->ExtraMeta = $htmlValue->getContent();
+    }
+
     /**
      * Trigger synchronisation of link tracking
      *
@@ -1802,6 +1826,16 @@ public function validate()
             );
         }
 
+        // Ensure ExtraMeta can be turned into valid HTML
+        if ($this->ExtraMeta && !HTMLValue::create($this->ExtraMeta)->getContent()) {
+            $result->addError(
+                _t(
+                    'SilverStripe\\CMS\\Model\\SiteTree.InvalidExtraMeta',
+                    'Custom Meta Tags does not contain valid HTML',
+                )
+            );
+        }
+
         return $result;
     }
 

diff --git a/lang/en.yml b/lang/en.yml
@@ -208,6 +208,7 @@ en:
     HTMLEDITORTITLE: Content
     INHERIT: 'Inherit from parent page'
     INHERITSITECONFIG: 'Inherit from site access settings'
+    InvalidExtraMeta: 'Custom Meta Tags does not contain valid HTML'
     LASTPUBLISHED: 'Last published'
     LASTSAVED: 'Last saved'
     LASTUPDATED: 'Last Updated'

diff --git a/tests/php/Model/SiteTreeTest.php b/tests/php/Model/SiteTreeTest.php
@@ -2017,4 +2017,51 @@ public function testCMSEditLink()
             $child->CMSEditLink()
         );
     }
+
+    /**
+     * @dataProvider provideSanitiseExtraMeta
+     */
+    public function testSanitiseExtraMeta(string $extraMeta, string $expected, string $message): void
+    {
+        $siteTree = new SiteTree();
+        $siteTree->ExtraMeta = $extraMeta;
+        $siteTree->write();
+        $this->assertSame($expected, $siteTree->ExtraMeta, $message);
+    }
+
+    public function provideSanitiseExtraMeta(): array
+    {
+        return [
+            [
+                '<link rel="canonical" accesskey="X" sometrigger="alert(1)" />',
+                '<link rel="canonical" sometrigger="alert(1)">',
+                'accesskey attribute is removed'
+            ],
+            [
+                '<link rel="canonical" onclick="alert(1)" /><meta name="x" onerror="alert(0)">',
+                '<link rel="canonical"><meta name="x">',
+                'Attributes starting with "on" are removed'
+            ],
+            [
+                '<link rel="canonical" onclick=alert(1) /><meta name="x" onerror=\'alert(0)\'>',
+                '<link rel="canonical"><meta name="x">',
+                'Attributes with different quote styles are removed'
+            ],
+            [
+                '<link rel="canonical" ONCLICK=alert(1) /><meta name="x" oNeRrOr=\'alert(0)\'>',
+                '<link rel="canonical"><meta name="x">',
+                'Mixed case attributes are removed'
+            ],
+            [
+                '<link rel="canonical" accesskey="X" onclick="alert(1)" name="x" />',
+                '<link rel="canonical" name="x">',
+                'Multiple attributes are removed'
+            ],
+            [
+                '<link rel="canonical" href="valid" ;;// somethingdodgy < onmouseover=alert(1)',
+                '<link rel="canonical" href="valid" somethingdodgy="">',
+                'Invalid HTML is converted to valid HTML and parsed'
+            ],
+        ];
+    }
 }