Home » HTML » HTML_BBCodeParser » Bug #5609

[2005-10-05 15:33 UTC] vanderaj at greebo dot net

Description:
------------
HTML_BBCodeParser fails to validate URL tags properly, and
allows XSS through.

Test script:
---------------
This post here describes the identical issue in phpBB 2.0.14 and below. It affects HTML_BBCodeParser in *exactly* the same way - all the examples in this exploit work as described.

http://castlecops.com/t123194-.html

Expected result:
----------------
XSS in any of the supported attributes should not work.

Actual result:
--------------
XSS occurs. Try it and see.

[2006-12-29 10:51 UTC] andrei_nikolov at mail dot bg

suggestion for fixing the bug:

adding new variable in the class:

/**
* Counter of closing [url] tags which must be left unparsed (XSS prevention)
*
* @access private
* @var int
*/
var $skipClosingTagsURL = 0;

...........
in function _buildParsedString():

// opening tag
case 1:
//Prevents XSS attacks:
if (($tag['tag'] == 'url' || $tag['tag'] == 'img') && preg_match('#(script|about|applet|activex|chrome):#is', $tag['text']))
{
$this->_parsed .= $tag['text'];
if ($tag['tag'] == 'url')
$this->skipClosingTagsURL++;

break;
}

.........

// closing tag
case 2:
if ($this->_definedTags[$tag['tag']]['htmlclose'] != '') {
if ($tag['tag'] == 'url' && $this->skipClosingTagsURL)
{
$this->_parsed .= $tag['text'];
$this->skipClosingTagsURL--;
}
else
$this->_parsed .= '</'.$this->_definedTags[$tag['tag']]['htmlclose'].'>';
}
break;

.......
function parse()
{
$this->skipClosingTagsURL = 0;
$this->_preparse();
$this->_buildTagArray();
$this->_validateTagArray();
$this->_buildParsedString();
}