Skip to content

Commit

Permalink
Merge pull request from GHSA-747v-52c4-8vj8
Browse files Browse the repository at this point in the history
Co-authored-by: Leo Feyer <1192057+leofeyer@users.noreply.github.com>
  • Loading branch information
ausi and leofeyer committed Apr 9, 2024
1 parent 55b995d commit 474a2fc
Show file tree
Hide file tree
Showing 4 changed files with 34 additions and 10 deletions.
5 changes: 4 additions & 1 deletion core-bundle/contao/library/Contao/Input.php
Original file line number Diff line number Diff line change
Expand Up @@ -1059,7 +1059,10 @@ public static function encodeInsertTags($varValue)
return $varValue;
}

return str_replace(array('{{', '}}'), array('&#123;&#123;', '&#125;&#125;'), (string) $varValue);
$varValue = str_replace(array('{{', '}}'), array('&#123;&#123;', '&#125;&#125;'), (string) $varValue);

// Encode single curly braces at the beginning and end of the string
return preg_replace(array('/^(\s*)\{|\{(\s*)$/', '/^(\s*)\}|\}(\s*)$/'), array('$1&#123;$2', '$1&#125;$2'), $varValue);
}

/**
Expand Down
3 changes: 2 additions & 1 deletion core-bundle/src/String/SimpleTokenParser.php
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@

namespace Contao\CoreBundle\String;

use Contao\Input;
use Psr\Log\LoggerAwareInterface;
use Psr\Log\LoggerAwareTrait;
use Psr\Log\LogLevel;
Expand Down Expand Up @@ -108,7 +109,7 @@ function (array $matches) use ($data) {
return '##'.$matches[1].'##';
}

return $data[$matches[1]];
return Input::encodeInsertTags($data[$matches[1]]);
},
$subject,
);
Expand Down
14 changes: 8 additions & 6 deletions core-bundle/tests/Contao/InputTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -168,8 +168,8 @@ public function testBackendRoundtrip(string $source, string $expected, string|nu
*/
public function testEncodesInsertTags(): void
{
$source = '{{ foo }}';
$encoded = '&#123;&#123; foo &#125;&#125;';
$source = ' {{ foo }} { bar } ';
$encoded = ' &#123;&#123; foo &#125;&#125; { bar &#125; ';

$_GET = $_POST = $_COOKIE = [
'key' => $source,
Expand Down Expand Up @@ -327,14 +327,14 @@ public function encodeInputProvider(): \Generator
*
* @group legacy
*/
public function testEncodeNoneMode(string $source, string $expected, string|null $expectedEncoded = null): void
public function testEncodeNoneMode(string $source, string $expected, string|null $expectedEncoded = null, string|null $expectedEncodedDouble = null): void
{
$expectedEncoded ??= $expected;

$this->assertSame($expected, Input::encodeInput($source, InputEncodingMode::encodeNone, false));
$this->assertSame($expectedEncoded, Input::encodeInput($source, InputEncodingMode::encodeNone));
$this->assertSame($expected.$expected, Input::encodeInput($source.$source, InputEncodingMode::encodeNone, false));
$this->assertSame($expectedEncoded.$expectedEncoded, Input::encodeInput($source.$source, InputEncodingMode::encodeNone));
$this->assertSame($expectedEncodedDouble ?? $expectedEncoded.$expectedEncoded, Input::encodeInput($source.$source, InputEncodingMode::encodeNone));

System::getContainer()->set('request_stack', $stack = new RequestStack());
$stack->push(new Request([], ['key' => $source]));
Expand All @@ -355,10 +355,12 @@ public function encodeNoneModeProvider(): \Generator
yield ['foo', 'foo'];
yield ['\X \0 \X', '\X &#92;0 \X'];
yield ["a\rb\r\nc\n\rd\ne", "a\nb\nc\n\nd\ne"];
yield ['{}', '{}'];
yield ['{}', '{}', '&#123;&#125;', '&#123;}{&#125;'];
yield ['{{}}', '{{}}', '&#123;&#123;&#125;&#125;'];
yield ['{{{}}}', '{{{}}}', '&#123;&#123;{&#125;&#125;}'];
yield ['{{{}}}', '{{{}}}', '&#123;&#123;{&#125;&#125;&#125;', '&#123;&#123;{&#125;&#125;}&#123;&#123;{&#125;&#125;&#125;'];
yield ['{{{{}}}}', '{{{{}}}}', '&#123;&#123;&#123;&#123;&#125;&#125;&#125;&#125;'];
yield ['{ start {and} end }', '{ start {and} end }', '&#123; start {and} end &#125;', '&#123; start {and} end }{ start {and} end &#125;'];
yield ["\n\t { foo }\n\t ", "\n\t { foo }\n\t ", "\n\t &#123; foo &#125;\n\t ", "\n\t &#123; foo }\n\t \n\t { foo &#125;\n\t "];
yield ["\0", "\u{FFFD}"];
yield ["\x80", "\u{FFFD}"];
yield ["\xFF", "\u{FFFD}"];
Expand Down
22 changes: 20 additions & 2 deletions core-bundle/tests/String/SimpleTokenParserTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -145,16 +145,34 @@ public function parseSimpleTokensProvider(): \Generator
'This is my ',
];

yield 'Test regular curly braces do not get encoded' => [
'##token##',
['token' => 'foo { bar } baz'],
'foo { bar } baz',
];

yield 'Test if-tags insertion not evaluated' => [
'##token##',
['token' => '{if token=="foo"}'],
'{if token=="foo"}',
'&#123;if token=="foo"&#125;',
];

yield 'Test insert tags insertion not possible' => [
'##token##',
['token' => '{{date}}'],
'&#123;&#123;date&#125;&#125;',
];

yield 'Test if-tags insertion not evaluated with multiple tokens' => [
'##token1####token2####token3##',
['token1' => '{', 'token2' => 'if', 'token3' => ' token=="foo"}'],
'{if token=="foo"}',
'&#123;if token=="foo"&#125;',
];

yield 'Test insert tags insertion not possible with multiple tokens' => [
'##token1####token2####token3##',
['token1' => '{', 'token2' => '{date}', 'token3' => '}'],
'&#123;&#123;date&#125;&#125;',
];

yield 'Test escaping works correctly' => [
Expand Down

0 comments on commit 474a2fc

Please sign in to comment.