From b5a997ce183fa655af4c03b5f92a58a1a3e7c2f1 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Tue, 16 Jul 2019 20:44:12 +0200 Subject: [PATCH 1/3] [ticket/security/243] Limit size values to supported values SECURITY-243 --- phpBB/language/en/posting.php | 1 + phpBB/phpbb/textformatter/s9e/parser.php | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/phpBB/language/en/posting.php b/phpBB/language/en/posting.php index 11ea6483e1..8f43ee7656 100644 --- a/phpBB/language/en/posting.php +++ b/phpBB/language/en/posting.php @@ -139,6 +139,7 @@ $lang = array_merge($lang, array( 'IMAGES_ARE_OFF' => '[img] is OFF', 'IMAGES_ARE_ON' => '[img] is ON', 'INVALID_FILENAME' => '%s is an invalid filename.', + 'INVALID_FONT_SIZE' => 'The font size you supplied is invalid: %s', 'LOAD' => 'Load', 'LOAD_DRAFT' => 'Load draft', diff --git a/phpBB/phpbb/textformatter/s9e/parser.php b/phpBB/phpbb/textformatter/s9e/parser.php index 3698dca224..e30bc2b0d9 100644 --- a/phpBB/phpbb/textformatter/s9e/parser.php +++ b/phpBB/phpbb/textformatter/s9e/parser.php @@ -228,6 +228,10 @@ class parser implements \phpbb\textformatter\parser_interface { $errors[] = array($msg); } + else if ($msg === 'INVALID_FONT_SIZE') + { + $errors[] = [$msg, $context['invalid_size']]; + } } // Deduplicate error messages. array_unique() only works on strings so we have to serialize @@ -335,6 +339,13 @@ class parser implements \phpbb\textformatter\parser_interface */ static public function filter_font_size($size, $max_size, Logger $logger) { + if (!is_int($size)) + { + $logger->err('INVALID_FONT_SIZE', ['invalid_size' => htmlspecialchars($size)]); + + return false; + } + if ($max_size && $size > $max_size) { $logger->err('MAX_FONT_SIZE_EXCEEDED', array('max_size' => $max_size)); From c934d3fcfdaaa1e8c2161577690fef9dcb41b1e1 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Wed, 17 Jul 2019 22:02:32 +0200 Subject: [PATCH 2/3] [ticket/security/243] Limit size BBCode to 4 numeric characters SECURITY-243 --- phpBB/phpbb/textformatter/s9e/factory.php | 2 +- phpBB/phpbb/textformatter/s9e/parser.php | 2 +- phpBB/styles/prosilver/template/bbcode.html | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/phpBB/phpbb/textformatter/s9e/factory.php b/phpBB/phpbb/textformatter/s9e/factory.php index 6191b9a315..d339e3311d 100644 --- a/phpBB/phpbb/textformatter/s9e/factory.php +++ b/phpBB/phpbb/textformatter/s9e/factory.php @@ -110,7 +110,7 @@ class factory implements \phpbb\textformatter\cache_interface 'i' => '', 'u' => '', 'img' => '{L_IMAGE}', - 'size' => '', + 'size' => 'font-size: %; line-height: normal', 'color' => '', 'email' => ' diff --git a/phpBB/phpbb/textformatter/s9e/parser.php b/phpBB/phpbb/textformatter/s9e/parser.php index e30bc2b0d9..1bc56a8cb4 100644 --- a/phpBB/phpbb/textformatter/s9e/parser.php +++ b/phpBB/phpbb/textformatter/s9e/parser.php @@ -339,7 +339,7 @@ class parser implements \phpbb\textformatter\parser_interface */ static public function filter_font_size($size, $max_size, Logger $logger) { - if (!is_int($size)) + if (!is_numeric($size)) { $logger->err('INVALID_FONT_SIZE', ['invalid_size' => htmlspecialchars($size)]); diff --git a/phpBB/styles/prosilver/template/bbcode.html b/phpBB/styles/prosilver/template/bbcode.html index 940c0ace29..f4ec94dbfe 100644 --- a/phpBB/styles/prosilver/template/bbcode.html +++ b/phpBB/styles/prosilver/template/bbcode.html @@ -64,7 +64,7 @@ {TEXT} -{TEXT} +font-size: %; line-height: normal {L_IMAGE} From f75577e5f858e43e202010f6889bd55096f75ea3 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Thu, 18 Jul 2019 22:32:19 +0200 Subject: [PATCH 3/3] [ticket/security/243] Use bbcode.html like formatting SECURITY-243 --- phpBB/phpbb/textformatter/s9e/factory.php | 2 +- tests/text_formatter/s9e/default_formatting_test.php | 2 +- tests/text_processing/tickets_data/PHPBB3-13921.html | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/phpBB/phpbb/textformatter/s9e/factory.php b/phpBB/phpbb/textformatter/s9e/factory.php index d339e3311d..dca1c78d40 100644 --- a/phpBB/phpbb/textformatter/s9e/factory.php +++ b/phpBB/phpbb/textformatter/s9e/factory.php @@ -110,7 +110,7 @@ class factory implements \phpbb\textformatter\cache_interface 'i' => '', 'u' => '', 'img' => '{L_IMAGE}', - 'size' => 'font-size: %; line-height: normal', + 'size' => 'font-size: %; line-height: normal', 'color' => '', 'email' => ' diff --git a/tests/text_formatter/s9e/default_formatting_test.php b/tests/text_formatter/s9e/default_formatting_test.php index a35c9138a5..1aa4f0bc3a 100644 --- a/tests/text_formatter/s9e/default_formatting_test.php +++ b/tests/text_formatter/s9e/default_formatting_test.php @@ -70,7 +70,7 @@ class phpbb_textformatter_s9e_default_formatting_test extends phpbb_test_case ), array( '[size=75]smaller[/size]', - 'smaller' + 'smaller' ), array( '[quote]quoted[/quote]', diff --git a/tests/text_processing/tickets_data/PHPBB3-13921.html b/tests/text_processing/tickets_data/PHPBB3-13921.html index 690668ef28..6a9dc7f504 100644 --- a/tests/text_processing/tickets_data/PHPBB3-13921.html +++ b/tests/text_processing/tickets_data/PHPBB3-13921.html @@ -1 +1 @@ -
xxx
\ No newline at end of file +
xxx
\ No newline at end of file