Changeset 662

Show
Ignore:
Timestamp:
10/05/2007 09:41:17 AM (14 months ago)
Author:
Geert
Message:

Optimizing xss_clean() regexes (phase 2)

Files:
1 modified

Legend:

Unmodified
Added
Removed

  • trunk/system/libraries/Input.php

    r661 r662  
    411411                //   * Used delimeters that aren't found in the pattern 
    412412                //   * Removed all unneeded escapes 
     413                //   * Deleted U modifiers and swapped greediness where needed 
    413414                // * Increased regex speed: 
    414415                //   * Made capturing parentheses non-capturing where possible 
    … …  
    427428 
    428429                // remove any attribute starting with "on" or xmlns 
    429                 $string = preg_replace('#(<[^>]+[\x00-\x20"\'])(?:on|xmlns)[^>]*>#iUu', '$1>', $string); 
     430                $string = preg_replace('#(<[^>]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*>#iu', '$1>', $string); 
    430431                // remove javascript: and vbscript: protocol 
    431                 $string = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iUu', '$1=$2nojavascript...', $string); 
    432                 $string = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iUu', '$1=$2novbscript...', $string); 
    433                 $string = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#Uu', '$1=$2nomozbinding...', $string); 
     432                $string = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2nojavascript...', $string); 
     433                $string = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $string); 
     434                $string = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $string); 
    434435                //<span style="width: expression(alert('Ping!'));"></span>  
    435436                // only works in ie... 
    436                 $string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*expression[\x00-\x20]*\([^>]*>#iU', '$1>', $string); 
    437                 $string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*behaviour[\x00-\x20]*\([^>]*>#iU', '$1>', $string); 
    438                 $string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*>#iUu', '$1>', $string); 
     437                $string = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*>#i', '$1>', $string); 
     438                $string = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*>#i', '$1>', $string); 
     439                $string = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*>#iu', '$1>', $string); 
    439440                //remove namespaced elements (we do not need them...) 
    440441                $string = preg_replace('#</*\w+:\w[^>]*>#i', '',$string);