From 551ff35344f7bedc2efe4e80667e5f2a9682f350 Mon Sep 17 00:00:00 2001 From: Bachir Soussi Chiadmi Date: Wed, 25 Apr 2018 20:08:51 +0200 Subject: [PATCH] core security update 8.5.3 --- composer.lock | 45 ++++---- core/lib/Drupal.php | 2 +- .../Drupal/Core/Security/RequestSanitizer.php | 100 ++++++++++++++---- core/modules/file/src/Element/ManagedFile.php | 4 + 4 files changed, 107 insertions(+), 44 deletions(-) diff --git a/composer.lock b/composer.lock index 1f5151358..a5837692f 100644 --- a/composer.lock +++ b/composer.lock @@ -124,16 +124,16 @@ }, { "name": "chi-teck/drupal-code-generator", - "version": "1.23.2", + "version": "1.24.0", "source": { "type": "git", "url": "https://github.com/Chi-teck/drupal-code-generator.git", - "reference": "b157b38c8c148c67d5b80c7c349b1a446115ea0e" + "reference": "20682ec4acc92e9671ba7b9bd0e972978c3a08f2" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/Chi-teck/drupal-code-generator/zipball/b157b38c8c148c67d5b80c7c349b1a446115ea0e", - "reference": "b157b38c8c148c67d5b80c7c349b1a446115ea0e", + "url": "https://api.github.com/repos/Chi-teck/drupal-code-generator/zipball/20682ec4acc92e9671ba7b9bd0e972978c3a08f2", + "reference": "20682ec4acc92e9671ba7b9bd0e972978c3a08f2", "shasum": "" }, "require": { @@ -159,7 +159,7 @@ "GPL-2.0-or-later" ], "description": "Drupal code generator", - "time": "2018-03-03T04:17:26+00:00" + "time": "2018-04-25T17:35:50+00:00" }, { "name": "composer/installers", @@ -1524,16 +1524,16 @@ }, { "name": "drupal/core", - "version": "8.5.2", + "version": "8.5.3", "source": { "type": "git", "url": "https://github.com/drupal/core.git", - "reference": "bc21760d4be4ad117851809183c8d18880ab275a" + "reference": "b012f0ae51504880e920f2c6efdbdf03b6fe2129" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/drupal/core/zipball/bc21760d4be4ad117851809183c8d18880ab275a", - "reference": "bc21760d4be4ad117851809183c8d18880ab275a", + "url": "https://api.github.com/repos/drupal/core/zipball/b012f0ae51504880e920f2c6efdbdf03b6fe2129", + "reference": "b012f0ae51504880e920f2c6efdbdf03b6fe2129", "shasum": "" }, "require": { @@ -1755,7 +1755,7 @@ "GPL-2.0-or-later" ], "description": "Drupal is an open source content management platform powering millions of websites and applications.", - "time": "2018-04-18T17:00:56+00:00" + "time": "2018-04-25T15:39:01+00:00" }, { "name": "drush/drush", @@ -4727,30 +4727,30 @@ }, { "name": "zendframework/zend-escaper", - "version": "2.5.2", + "version": "2.6.0", "source": { "type": "git", "url": "https://github.com/zendframework/zend-escaper.git", - "reference": "2dcd14b61a72d8b8e27d579c6344e12c26141d4e" + "reference": "31d8aafae982f9568287cb4dce987e6aff8fd074" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/zendframework/zend-escaper/zipball/2dcd14b61a72d8b8e27d579c6344e12c26141d4e", - "reference": "2dcd14b61a72d8b8e27d579c6344e12c26141d4e", + "url": "https://api.github.com/repos/zendframework/zend-escaper/zipball/31d8aafae982f9568287cb4dce987e6aff8fd074", + "reference": "31d8aafae982f9568287cb4dce987e6aff8fd074", "shasum": "" }, "require": { - "php": ">=5.5" + "php": "^5.6 || ^7.0" }, "require-dev": { - "fabpot/php-cs-fixer": "1.7.*", - "phpunit/phpunit": "~4.0" + "phpunit/phpunit": "^5.7.27 || ^6.5.8 || ^7.1.2", + "zendframework/zend-coding-standard": "~1.0.0" }, "type": "library", "extra": { "branch-alias": { - "dev-master": "2.5-dev", - "dev-develop": "2.6-dev" + "dev-master": "2.6.x-dev", + "dev-develop": "2.7.x-dev" } }, "autoload": { @@ -4762,12 +4762,13 @@ "license": [ "BSD-3-Clause" ], - "homepage": "https://github.com/zendframework/zend-escaper", + "description": "Securely and safely escape HTML, HTML attributes, JavaScript, CSS, and URLs", "keywords": [ + "ZendFramework", "escaper", - "zf2" + "zf" ], - "time": "2016-06-30T19:48:38+00:00" + "time": "2018-04-25T15:48:53+00:00" }, { "name": "zendframework/zend-feed", diff --git a/core/lib/Drupal.php b/core/lib/Drupal.php index 8609b9255..91d703228 100644 --- a/core/lib/Drupal.php +++ b/core/lib/Drupal.php @@ -82,7 +82,7 @@ class Drupal { /** * The current system version. */ - const VERSION = '8.5.2'; + const VERSION = '8.5.3'; /** * Core API compatibility. diff --git a/core/lib/Drupal/Core/Security/RequestSanitizer.php b/core/lib/Drupal/Core/Security/RequestSanitizer.php index 8ba17b95c..44815f68c 100644 --- a/core/lib/Drupal/Core/Security/RequestSanitizer.php +++ b/core/lib/Drupal/Core/Security/RequestSanitizer.php @@ -2,6 +2,8 @@ namespace Drupal\Core\Security; +use Drupal\Component\Utility\UrlHelper; +use Symfony\Component\HttpFoundation\ParameterBag; use Symfony\Component\HttpFoundation\Request; /** @@ -39,28 +41,18 @@ class RequestSanitizer { */ public static function sanitize(Request $request, $whitelist, $log_sanitized_keys = FALSE) { if (!$request->attributes->get(self::SANITIZED, FALSE)) { - // Process query string parameters. - $get_sanitized_keys = []; - $request->query->replace(static::stripDangerousValues($request->query->all(), $whitelist, $get_sanitized_keys)); - if ($log_sanitized_keys && !empty($get_sanitized_keys)) { - trigger_error(sprintf('Potentially unsafe keys removed from query string parameters (GET): %s', implode(', ', $get_sanitized_keys))); + $update_globals = FALSE; + $bags = [ + 'query' => 'Potentially unsafe keys removed from query string parameters (GET): %s', + 'request' => 'Potentially unsafe keys removed from request body parameters (POST): %s', + 'cookies' => 'Potentially unsafe keys removed from cookie parameters: %s', + ]; + foreach ($bags as $bag => $message) { + if (static::processParameterBag($request->$bag, $whitelist, $log_sanitized_keys, $bag, $message)) { + $update_globals = TRUE; + } } - - // Request body parameters. - $post_sanitized_keys = []; - $request->request->replace(static::stripDangerousValues($request->request->all(), $whitelist, $post_sanitized_keys)); - if ($log_sanitized_keys && !empty($post_sanitized_keys)) { - trigger_error(sprintf('Potentially unsafe keys removed from request body parameters (POST): %s', implode(', ', $post_sanitized_keys))); - } - - // Cookie parameters. - $cookie_sanitized_keys = []; - $request->cookies->replace(static::stripDangerousValues($request->cookies->all(), $whitelist, $cookie_sanitized_keys)); - if ($log_sanitized_keys && !empty($cookie_sanitized_keys)) { - trigger_error(sprintf('Potentially unsafe keys removed from cookie parameters: %s', implode(', ', $cookie_sanitized_keys))); - } - - if (!empty($get_sanitized_keys) || !empty($post_sanitized_keys) || !empty($cookie_sanitized_keys)) { + if ($update_globals) { $request->overrideGlobals(); } $request->attributes->set(self::SANITIZED, TRUE); @@ -68,6 +60,72 @@ class RequestSanitizer { return $request; } + /** + * Processes a request parameter bag. + * + * @param \Symfony\Component\HttpFoundation\ParameterBag $bag + * The parameter bag to process. + * @param string[] $whitelist + * An array of keys to whitelist as safe. + * @param bool $log_sanitized_keys + * Set to TRUE to log keys that are sanitized. + * @param string $bag_name + * The request parameter bag name. Either 'query', 'request' or 'cookies'. + * @param string $message + * The message to log if the parameter bag contains keys that are removed. + * If the message contains %s that is replaced by a list of removed keys. + * + * @return bool + * TRUE if the parameter bag has been sanitized, FALSE if not. + */ + protected static function processParameterBag(ParameterBag $bag, $whitelist, $log_sanitized_keys, $bag_name, $message) { + $sanitized = FALSE; + $sanitized_keys = []; + $bag->replace(static::stripDangerousValues($bag->all(), $whitelist, $sanitized_keys)); + if (!empty($sanitized_keys)) { + $sanitized = TRUE; + if ($log_sanitized_keys) { + trigger_error(sprintf($message, implode(', ', $sanitized_keys))); + } + } + + if ($bag->has('destination')) { + $destination_dangerous_keys = static::checkDestination($bag->get('destination'), $whitelist); + if (!empty($destination_dangerous_keys)) { + // The destination is removed rather than sanitized because the URL + // generator service is not available and this method is called very + // early in the bootstrap. + $bag->remove('destination'); + $sanitized = TRUE; + if ($log_sanitized_keys) { + trigger_error(sprintf('Potentially unsafe destination removed from %s parameter bag because it contained the following keys: %s', $bag_name, implode(', ', $destination_dangerous_keys))); + } + } + } + return $sanitized; + } + + /** + * Checks a destination string to see if it is dangerous. + * + * @param string $destination + * The destination string to check. + * @param array $whitelist + * An array of keys to whitelist as safe. + * + * @return array + * The dangerous keys found in the destination parameter. + */ + protected static function checkDestination($destination, array $whitelist) { + $dangerous_keys = []; + $parts = UrlHelper::parse($destination); + // If there is a query string, check its query parameters. + if (!empty($parts['query'])) { + static::stripDangerousValues($parts['query'], $whitelist, $dangerous_keys); + } + return $dangerous_keys; + } + /** * Strips dangerous keys from $input. * diff --git a/core/modules/file/src/Element/ManagedFile.php b/core/modules/file/src/Element/ManagedFile.php index ca4e887a1..6f01ee552 100644 --- a/core/modules/file/src/Element/ManagedFile.php +++ b/core/modules/file/src/Element/ManagedFile.php @@ -8,6 +8,7 @@ use Drupal\Component\Utility\NestedArray; use Drupal\Core\Ajax\AjaxResponse; use Drupal\Core\Ajax\ReplaceCommand; use Drupal\Core\Form\FormStateInterface; +use Drupal\Core\Render\Element; use Drupal\Core\Render\Element\FormElement; use Drupal\Core\Site\Settings; use Drupal\Core\Url; @@ -175,6 +176,9 @@ class ManagedFile extends FormElement { $form_parents = explode('/', $request->query->get('element_parents')); + // Sanitize form parents before using them. + $form_parents = array_filter($form_parents, [Element::class, 'child']); + // Retrieve the element to be rendered. $form = NestedArray::getValue($form, $form_parents);