Latte: apply modifier safeUrl automatically to attribute href

[dg]

Yes, this is not about escaping, this is sanitization. In fact, escapeXML() provides some kind of sanitization too. Pros and cons?

[enumag]

What about src?

[Majkl578]

Is there a way to turn it off?

[dg]

no

yes, with |nosafeurl

[Majkl578]

This:

<a href=https://example.com/?id={$id}></a>

produces:

<a href=https://example.com/?id="123"></a>

[Majkl578]

Plus I think variant without protocol should be considered valid as well, it's a standard way on sites using both SSL and non-SSL variant.

[milo]

I am in.

Pros

10x security

Cons

Relative URLs like {link Presenter:action}? Just now I cannot imagine if will work or not.
Hard to add next allowed protocol, e.g. nntp://, or editor://
BC break which is hard to find.

Is there a way to turn it off?

What about n:unsafeHref="$url".

It is hard to list or distinct between safe/unsafe protocols :(

[fprochazka]

What about Utils\Html ?

[Majkl578]

What about Utils\Html?

Why would you pass html as a value of href/src? But I am thinking about Http\Url.

[dg]

I added |nosafeurl modifier.

It works without protocol, or not? {link Presenter:action} works too, or not?

Ad it produces <a href=https://example.com/?id="123"></a> - yes, for the past two years.

[soaj1664]

You may also include the following attributes for safeURL:

xlink:href
action
formaction
data attribute e.g. on object tag: see http://jsfiddle.net/2Tx5L/ in Firefox.

Regards,

ashar

[fprochazka]

I was speaking about href attributes in Html objects, how they should act?

[Majkl578]

I was speaking about href attributes in Html objects, how they should act?

Well, it has nothing to do with Latte so I guess it should stay untouched by this.

[soaj1664]

@dg @milo Good to see that now you have added action, formaction attributes for "safeURL" stuff! It would be great if you will also add the following: (attributes along with related XSS vector)

1. xlink:href
   <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script Here is the related Fiddle: http://jsfiddle.net/gwTz5/1/
   It is a candidate for safeURL: see https://developer.mozilla.org/en-US/docs/Web/SVG/Attribute/xlink:href

2. x:href (It works in Opera only)
   <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' Here is the related Fiddle: http://jsfiddle.net/XVECQ/1/

3. data attribute of object Tag (see: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/object)
   XSS vector is: <object/data=javascript:alert(1)> and Fiddle (works in Firefox: http://jsfiddle.net/gwTz5/2/)

I hope it helps!

Regards,

ashar

[dg]

I added support for <object data>. SVG is not supported (and maybe not works with Latte), so this attributes are not automatically shielded.