core security update 8.5.3
This commit is contained in:
Generated
+23
-22
@@ -124,16 +124,16 @@
|
||||
},
|
||||
{
|
||||
"name": "chi-teck/drupal-code-generator",
|
||||
"version": "1.23.2",
|
||||
"version": "1.24.0",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/Chi-teck/drupal-code-generator.git",
|
||||
"reference": "b157b38c8c148c67d5b80c7c349b1a446115ea0e"
|
||||
"reference": "20682ec4acc92e9671ba7b9bd0e972978c3a08f2"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/Chi-teck/drupal-code-generator/zipball/b157b38c8c148c67d5b80c7c349b1a446115ea0e",
|
||||
"reference": "b157b38c8c148c67d5b80c7c349b1a446115ea0e",
|
||||
"url": "https://api.github.com/repos/Chi-teck/drupal-code-generator/zipball/20682ec4acc92e9671ba7b9bd0e972978c3a08f2",
|
||||
"reference": "20682ec4acc92e9671ba7b9bd0e972978c3a08f2",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
@@ -159,7 +159,7 @@
|
||||
"GPL-2.0-or-later"
|
||||
],
|
||||
"description": "Drupal code generator",
|
||||
"time": "2018-03-03T04:17:26+00:00"
|
||||
"time": "2018-04-25T17:35:50+00:00"
|
||||
},
|
||||
{
|
||||
"name": "composer/installers",
|
||||
@@ -1524,16 +1524,16 @@
|
||||
},
|
||||
{
|
||||
"name": "drupal/core",
|
||||
"version": "8.5.2",
|
||||
"version": "8.5.3",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/drupal/core.git",
|
||||
"reference": "bc21760d4be4ad117851809183c8d18880ab275a"
|
||||
"reference": "b012f0ae51504880e920f2c6efdbdf03b6fe2129"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/drupal/core/zipball/bc21760d4be4ad117851809183c8d18880ab275a",
|
||||
"reference": "bc21760d4be4ad117851809183c8d18880ab275a",
|
||||
"url": "https://api.github.com/repos/drupal/core/zipball/b012f0ae51504880e920f2c6efdbdf03b6fe2129",
|
||||
"reference": "b012f0ae51504880e920f2c6efdbdf03b6fe2129",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
@@ -1755,7 +1755,7 @@
|
||||
"GPL-2.0-or-later"
|
||||
],
|
||||
"description": "Drupal is an open source content management platform powering millions of websites and applications.",
|
||||
"time": "2018-04-18T17:00:56+00:00"
|
||||
"time": "2018-04-25T15:39:01+00:00"
|
||||
},
|
||||
{
|
||||
"name": "drush/drush",
|
||||
@@ -4727,30 +4727,30 @@
|
||||
},
|
||||
{
|
||||
"name": "zendframework/zend-escaper",
|
||||
"version": "2.5.2",
|
||||
"version": "2.6.0",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/zendframework/zend-escaper.git",
|
||||
"reference": "2dcd14b61a72d8b8e27d579c6344e12c26141d4e"
|
||||
"reference": "31d8aafae982f9568287cb4dce987e6aff8fd074"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/zendframework/zend-escaper/zipball/2dcd14b61a72d8b8e27d579c6344e12c26141d4e",
|
||||
"reference": "2dcd14b61a72d8b8e27d579c6344e12c26141d4e",
|
||||
"url": "https://api.github.com/repos/zendframework/zend-escaper/zipball/31d8aafae982f9568287cb4dce987e6aff8fd074",
|
||||
"reference": "31d8aafae982f9568287cb4dce987e6aff8fd074",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"php": ">=5.5"
|
||||
"php": "^5.6 || ^7.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"fabpot/php-cs-fixer": "1.7.*",
|
||||
"phpunit/phpunit": "~4.0"
|
||||
"phpunit/phpunit": "^5.7.27 || ^6.5.8 || ^7.1.2",
|
||||
"zendframework/zend-coding-standard": "~1.0.0"
|
||||
},
|
||||
"type": "library",
|
||||
"extra": {
|
||||
"branch-alias": {
|
||||
"dev-master": "2.5-dev",
|
||||
"dev-develop": "2.6-dev"
|
||||
"dev-master": "2.6.x-dev",
|
||||
"dev-develop": "2.7.x-dev"
|
||||
}
|
||||
},
|
||||
"autoload": {
|
||||
@@ -4762,12 +4762,13 @@
|
||||
"license": [
|
||||
"BSD-3-Clause"
|
||||
],
|
||||
"homepage": "https://github.com/zendframework/zend-escaper",
|
||||
"description": "Securely and safely escape HTML, HTML attributes, JavaScript, CSS, and URLs",
|
||||
"keywords": [
|
||||
"ZendFramework",
|
||||
"escaper",
|
||||
"zf2"
|
||||
"zf"
|
||||
],
|
||||
"time": "2016-06-30T19:48:38+00:00"
|
||||
"time": "2018-04-25T15:48:53+00:00"
|
||||
},
|
||||
{
|
||||
"name": "zendframework/zend-feed",
|
||||
|
||||
+1
-1
@@ -82,7 +82,7 @@ class Drupal {
|
||||
/**
|
||||
* The current system version.
|
||||
*/
|
||||
const VERSION = '8.5.2';
|
||||
const VERSION = '8.5.3';
|
||||
|
||||
/**
|
||||
* Core API compatibility.
|
||||
|
||||
@@ -2,6 +2,8 @@
|
||||
|
||||
namespace Drupal\Core\Security;
|
||||
|
||||
use Drupal\Component\Utility\UrlHelper;
|
||||
use Symfony\Component\HttpFoundation\ParameterBag;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
|
||||
/**
|
||||
@@ -39,28 +41,18 @@ class RequestSanitizer {
|
||||
*/
|
||||
public static function sanitize(Request $request, $whitelist, $log_sanitized_keys = FALSE) {
|
||||
if (!$request->attributes->get(self::SANITIZED, FALSE)) {
|
||||
// Process query string parameters.
|
||||
$get_sanitized_keys = [];
|
||||
$request->query->replace(static::stripDangerousValues($request->query->all(), $whitelist, $get_sanitized_keys));
|
||||
if ($log_sanitized_keys && !empty($get_sanitized_keys)) {
|
||||
trigger_error(sprintf('Potentially unsafe keys removed from query string parameters (GET): %s', implode(', ', $get_sanitized_keys)));
|
||||
$update_globals = FALSE;
|
||||
$bags = [
|
||||
'query' => 'Potentially unsafe keys removed from query string parameters (GET): %s',
|
||||
'request' => 'Potentially unsafe keys removed from request body parameters (POST): %s',
|
||||
'cookies' => 'Potentially unsafe keys removed from cookie parameters: %s',
|
||||
];
|
||||
foreach ($bags as $bag => $message) {
|
||||
if (static::processParameterBag($request->$bag, $whitelist, $log_sanitized_keys, $bag, $message)) {
|
||||
$update_globals = TRUE;
|
||||
}
|
||||
}
|
||||
|
||||
// Request body parameters.
|
||||
$post_sanitized_keys = [];
|
||||
$request->request->replace(static::stripDangerousValues($request->request->all(), $whitelist, $post_sanitized_keys));
|
||||
if ($log_sanitized_keys && !empty($post_sanitized_keys)) {
|
||||
trigger_error(sprintf('Potentially unsafe keys removed from request body parameters (POST): %s', implode(', ', $post_sanitized_keys)));
|
||||
}
|
||||
|
||||
// Cookie parameters.
|
||||
$cookie_sanitized_keys = [];
|
||||
$request->cookies->replace(static::stripDangerousValues($request->cookies->all(), $whitelist, $cookie_sanitized_keys));
|
||||
if ($log_sanitized_keys && !empty($cookie_sanitized_keys)) {
|
||||
trigger_error(sprintf('Potentially unsafe keys removed from cookie parameters: %s', implode(', ', $cookie_sanitized_keys)));
|
||||
}
|
||||
|
||||
if (!empty($get_sanitized_keys) || !empty($post_sanitized_keys) || !empty($cookie_sanitized_keys)) {
|
||||
if ($update_globals) {
|
||||
$request->overrideGlobals();
|
||||
}
|
||||
$request->attributes->set(self::SANITIZED, TRUE);
|
||||
@@ -68,6 +60,72 @@ class RequestSanitizer {
|
||||
return $request;
|
||||
}
|
||||
|
||||
/**
|
||||
* Processes a request parameter bag.
|
||||
*
|
||||
* @param \Symfony\Component\HttpFoundation\ParameterBag $bag
|
||||
* The parameter bag to process.
|
||||
* @param string[] $whitelist
|
||||
* An array of keys to whitelist as safe.
|
||||
* @param bool $log_sanitized_keys
|
||||
* Set to TRUE to log keys that are sanitized.
|
||||
* @param string $bag_name
|
||||
* The request parameter bag name. Either 'query', 'request' or 'cookies'.
|
||||
* @param string $message
|
||||
* The message to log if the parameter bag contains keys that are removed.
|
||||
* If the message contains %s that is replaced by a list of removed keys.
|
||||
*
|
||||
* @return bool
|
||||
* TRUE if the parameter bag has been sanitized, FALSE if not.
|
||||
*/
|
||||
protected static function processParameterBag(ParameterBag $bag, $whitelist, $log_sanitized_keys, $bag_name, $message) {
|
||||
$sanitized = FALSE;
|
||||
$sanitized_keys = [];
|
||||
$bag->replace(static::stripDangerousValues($bag->all(), $whitelist, $sanitized_keys));
|
||||
if (!empty($sanitized_keys)) {
|
||||
$sanitized = TRUE;
|
||||
if ($log_sanitized_keys) {
|
||||
trigger_error(sprintf($message, implode(', ', $sanitized_keys)));
|
||||
}
|
||||
}
|
||||
|
||||
if ($bag->has('destination')) {
|
||||
$destination_dangerous_keys = static::checkDestination($bag->get('destination'), $whitelist);
|
||||
if (!empty($destination_dangerous_keys)) {
|
||||
// The destination is removed rather than sanitized because the URL
|
||||
// generator service is not available and this method is called very
|
||||
// early in the bootstrap.
|
||||
$bag->remove('destination');
|
||||
$sanitized = TRUE;
|
||||
if ($log_sanitized_keys) {
|
||||
trigger_error(sprintf('Potentially unsafe destination removed from %s parameter bag because it contained the following keys: %s', $bag_name, implode(', ', $destination_dangerous_keys)));
|
||||
}
|
||||
}
|
||||
}
|
||||
return $sanitized;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks a destination string to see if it is dangerous.
|
||||
*
|
||||
* @param string $destination
|
||||
* The destination string to check.
|
||||
* @param array $whitelist
|
||||
* An array of keys to whitelist as safe.
|
||||
*
|
||||
* @return array
|
||||
* The dangerous keys found in the destination parameter.
|
||||
*/
|
||||
protected static function checkDestination($destination, array $whitelist) {
|
||||
$dangerous_keys = [];
|
||||
$parts = UrlHelper::parse($destination);
|
||||
// If there is a query string, check its query parameters.
|
||||
if (!empty($parts['query'])) {
|
||||
static::stripDangerousValues($parts['query'], $whitelist, $dangerous_keys);
|
||||
}
|
||||
return $dangerous_keys;
|
||||
}
|
||||
|
||||
/**
|
||||
* Strips dangerous keys from $input.
|
||||
*
|
||||
|
||||
@@ -8,6 +8,7 @@ use Drupal\Component\Utility\NestedArray;
|
||||
use Drupal\Core\Ajax\AjaxResponse;
|
||||
use Drupal\Core\Ajax\ReplaceCommand;
|
||||
use Drupal\Core\Form\FormStateInterface;
|
||||
use Drupal\Core\Render\Element;
|
||||
use Drupal\Core\Render\Element\FormElement;
|
||||
use Drupal\Core\Site\Settings;
|
||||
use Drupal\Core\Url;
|
||||
@@ -175,6 +176,9 @@ class ManagedFile extends FormElement {
|
||||
|
||||
$form_parents = explode('/', $request->query->get('element_parents'));
|
||||
|
||||
// Sanitize form parents before using them.
|
||||
$form_parents = array_filter($form_parents, [Element::class, 'child']);
|
||||
|
||||
// Retrieve the element to be rendered.
|
||||
$form = NestedArray::getValue($form, $form_parents);
|
||||
|
||||
|
||||
Reference in New Issue
Block a user