zlib.output_compression makes its buffer non-removable once it has sent
compressed output, so ob_end_clean() raised a notice that replaced the
original exception. Fixes#704.
escapeButPreserveUris() matched any scheme via [A-z]+?://, which also
turns javascript://, vbscript:// and data:// URIs into clickable links
on the generated error page, allowing script execution on click (XSS).
The [A-z] class was also invalid, spanning extra ASCII punctuation.
Restrict the scheme to http/https, the only two schemes that make
sense to linkify on an error page, leaving other schemes as plain
escaped text.
escapeButPreserveUris() matched any scheme via [A-z]+?://, which also
turns javascript://, vbscript:// and data:// URIs into clickable links
on the generated error page, allowing script execution on click (XSS).
The [A-z] class was also invalid, spanning extra ASCII punctuation.
Restrict the scheme to http/https, the only two schemes that make
sense to linkify on an error page, leaving other schemes as plain
escaped text.
escapeButPreserveUris() matched the scheme with "[A-z]+?://", which accepts
any scheme. A frame comment containing javascript://x.co/?%0Aalert(1) survives
htmlspecialchars() untouched and was then wrapped in an anchor, so clicking it
executed script in the origin of the error page. "[A-z]" is also a code point
range rather than a letter class, so it additionally matched the six characters
between "Z" and "a", making "_://x.co/a" a link too.
Match the scheme with "https?" instead, case-insensitively so uppercase
"HTTP://" keeps working. Other schemes stay as escaped plain text. The editor
integration links are not affected, they are emitted directly by the template
and never pass through this method.
Fixes#791
dualfroz
upstream