Fixes #9615 - Upgrade to Htmlsanitizer v5 (#9856)

(cherry picked from commit a6e1c2e901)
2021-02-22 21:53:53 +13:00
parent 64117921ea
commit 388e0283bc
6 changed files with 48 additions and 15 deletions
--- a/build/NuSpecs/UmbracoCms.Web.nuspec
+++ b/build/NuSpecs/UmbracoCms.Web.nuspec
@@ -42,6 +42,7 @@
                <dependency id="Microsoft.Owin.Security.Cookies" version="[4.0.1,4.999999)" />
                <dependency id="Microsoft.Owin.Security.OAuth" version="[4.0.1,4.999999)" />
                <dependency id="System.Threading.Tasks.Dataflow" version="[4.9.0,4.999999)" />
+                <dependency id="HtmlSanitizer" version="[5.0.376,5.999999)" />

            </group>

--- a/src/Umbraco.Core/Constants-SvgSanitizer.cs
+++ b/src/Umbraco.Core/Constants-SvgSanitizer.cs
@@ -0,0 +1,23 @@
+using System.Collections.Generic;
+
+namespace Umbraco.Core
+{
+    public static partial class Constants
+    {
+        /// <summary>
+        /// Defines the alias identifiers for Umbraco's core application sections.
+        /// </summary>
+        public static class SvgSanitizer
+        {
+            /// <summary>
+            /// Allowlist for SVG attributes.
+            /// </summary>
+            public static readonly IList<string> Attributes = new [] { "accent-height", "accumulate", "additive", "alignment-baseline", "allowReorder", "alphabetic", "amplitude", "arabic-form", "ascent", "attributeName", "attributeType", "autoReverse", "azimuth", "baseFrequency", "baseline-shift", "baseProfile", "bbox", "begin", "bias", "by", "calcMode", "cap-height", "class", "clip", "clipPathUnits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "contentScriptType", "contentStyleType", "cursor", "cx", "cy", "d", "decelerate", "descent", "diffuseConstant", "direction", "display", "divisor", "dominant-baseline", "dur", "dx", "dy", "edgeMode", "elevation", "enable-background", "end", "exponent", "externalResourcesRequired", "Section", "fill", "fill-opacity", "fill-rule", "filter", "filterRes", "filterUnits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "format", "from", "fr", "fx", "fy", "g1", "g2", "glyph-name", "glyph-orientation-horizontal", "glyph-orientation-vertical", "glyphRef", "gradientTransform", "gradientUnits", "hanging", "height", "href", "hreflang", "horiz-adv-x", "horiz-origin-x", "ISection", "id", "ideographic", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kernelMatrix", "kernelUnitLength", "kerning", "keyPoints", "keySplines", "keyTimes", "lang", "lengthAdjust", "letter-spacing", "lighting-color", "limitingConeAngle", "local", "MSection", "marker-end", "marker-mid", "marker-start", "markerHeight", "markerUnits", "markerWidth", "mask", "maskContentUnits", "maskUnits", "mathematical", "max", "media", "method", "min", "mode", "NSection", "name", "numOctaves", "offset", "opacity", "operator", "order", "orient", "orientation", "origin", "overflow", "overline-position", "overline-thickness", "panose-1", "paint-order", "path", "pathLength", "patternContentUnits", "patternTransform", "patternUnits", "ping", "pointer-events", "points", "pointsAtX", "pointsAtY", "pointsAtZ", "preserveAlpha", "preserveAspectRatio", "primitiveUnits", "r", "radius", "referrerPolicy", "refX", "refY", "rel", "rendering-intent", "repeatCount", "repeatDur", "requiredExtensions", "requiredFeatures", "restart", "result", "rotate", "rx", "ry", "scale", "seed", "shape-rendering", "slope", "spacing", "specularConstant", "specularExponent", "speed", "spreadMethod", "startOffset", "stdDeviation", "stemh", "stemv", "stitchTiles", "stop-color", "stop-opacity", "strikethrough-position", "strikethrough-thickness", "string", "stroke", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke-width", "style", "surfaceScale", "systemLanguage", "tabindex", "tableValues", "target", "targetX", "targetY", "text-anchor", "text-decoration", "text-rendering", "textLength", "to", "transform", "type", "u1", "u2", "underline-position", "underline-thickness", "unicode", "unicode-bidi", "unicode-range", "units-per-em", "v-alphabetic", "v-hanging", "v-ideographic", "v-mathematical", "values", "vector-effect", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "viewBox", "viewTarget", "visibility", "width", "widths", "word-spacing", "writing-mode", "x", "x-height", "x1", "x2", "xChannelSelector", "xlink:actuate", "xlink:arcrole", "xlink:href", "xlink:role", "xlink:show", "xlink:title", "xlink:type", "xml:base", "xml:lang", "xml:space", "y", "y1", "y2", "yChannelSelector", "z", "zoomAndPan" };
+
+            /// <summary>
+            /// Allowlist for SVG tabs.
+            /// </summary>
+            public static readonly IList<string> Tags = new [] { "a", "altGlyph", "altGlyphDef", "altGlyphItem", "animate", "animateColor", "animateMotion", "animateTransform", "circle", "clipPath", "color-profile", "cursor", "defs", "desc", "discard", "ellipse", "feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feDropShadow", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence", "filter", "font", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "foreignObject", "g", "glyph", "glyphRef", "hatch", "hatchpath", "hkern", "image", "line", "linearGradient", "marker", "mask", "mesh", "meshgradient", "meshpatch", "meshrow", "metadata", "missing-glyph", "mpath", "path", "pattern", "polygon", "polyline", "radialGradient", "rect", "set", "solidcolor", "stop", "svg", "switch", "symbol", "text", "textPath", "title", "tref", "tspan", "unknown", "use", "view", "vkern" };
+        }
+    }
+}
--- a/src/Umbraco.Core/Umbraco.Core.csproj
+++ b/src/Umbraco.Core/Umbraco.Core.csproj
@@ -256,6 +256,7 @@
    <Compile Include="CompositionExtensions_Essentials.cs" />
    <Compile Include="CompositionExtensions_FileSystems.cs" />
    <Compile Include="CompositionExtensions_Uniques.cs" />
+    <Compile Include="Constants-SvgSanitizer.cs" />
    <Compile Include="Exceptions\PanicException.cs" />
    <Compile Include="FactoryExtensions.cs" />
    <Compile Include="Composing\RegisterFactory.cs" />
--- a/src/Umbraco.Web/Runtime/WebInitialComposer.cs
+++ b/src/Umbraco.Web/Runtime/WebInitialComposer.cs
@@ -40,6 +40,7 @@ using Current = Umbraco.Web.Composing.Current;
 using Umbraco.Web.PropertyEditors;
 using Umbraco.Core.Models;
 using Umbraco.Web.Models;
+using Ganss.XSS;

 namespace Umbraco.Web.Runtime
 {
@@ -139,6 +140,14 @@ namespace Umbraco.Web.Runtime
            composition.RegisterUnique<ISectionService, SectionService>();
            composition.RegisterUnique<IDashboardService, DashboardService>();
            composition.RegisterUnique<IIconService, IconService>();
+            composition.Register<IHtmlSanitizer>(_ =>
+            {
+                var sanitizer = new HtmlSanitizer();
+                sanitizer.AllowedAttributes.UnionWith(Umbraco.Core.Constants.SvgSanitizer.Attributes);
+                sanitizer.AllowedCssProperties.UnionWith(Umbraco.Core.Constants.SvgSanitizer.Attributes);
+                sanitizer.AllowedTags.UnionWith(Umbraco.Core.Constants.SvgSanitizer.Tags);
+                return sanitizer;
+            },Lifetime.Singleton);

            composition.RegisterUnique<IExamineManager>(factory => ExamineManager.Instance);

--- a/src/Umbraco.Web/Services/IconService.cs
+++ b/src/Umbraco.Web/Services/IconService.cs
@@ -1,6 +1,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
+using Ganss.XSS;
 using Umbraco.Core;
 using Umbraco.Core.Configuration;
 using Umbraco.Core.IO;
@@ -12,31 +13,24 @@ namespace Umbraco.Web.Services
    public class IconService : IIconService
    {
        private readonly IGlobalSettings _globalSettings;
+        private readonly IHtmlSanitizer _htmlSanitizer;

-        public IconService(IGlobalSettings globalSettings)
+        public IconService(IGlobalSettings globalSettings, IHtmlSanitizer htmlSanitizer)
        {
            _globalSettings = globalSettings;
+            _htmlSanitizer = htmlSanitizer;
        }


        /// <inheritdoc />
        public IList<IconModel> GetAllIcons()
        {
-            var icons = new List<IconModel>();
            var directory = new DirectoryInfo(IOHelper.MapPath($"{_globalSettings.IconsPath}/"));
            var iconNames = directory.GetFiles("*.svg");

-            iconNames.OrderBy(f => f.Name).ToList().ForEach(iconInfo =>
-            {
-                var icon = GetIcon(iconInfo);
+            return iconNames.OrderBy(f => f.Name)
+                .Select(iconInfo => GetIcon(iconInfo)).WhereNotNull().ToList();

-                if (icon != null)
-                {
-                    icons.Add(icon);
-                }
-            });
-
-            return icons;
        }

        /// <inheritdoc />
@@ -70,10 +64,12 @@ namespace Umbraco.Web.Services
            try
            {
                var svgContent = System.IO.File.ReadAllText(iconPath);
+                var sanitizedString = _htmlSanitizer.Sanitize(svgContent);
+
                var svg = new IconModel
                {
                    Name = iconName,
-                    SvgString = svgContent
+                    SvgString = sanitizedString
                };

                return svg;
--- a/src/Umbraco.Web/Umbraco.Web.csproj
+++ b/src/Umbraco.Web/Umbraco.Web.csproj
@@ -65,6 +65,9 @@
    <PackageReference Include="CSharpTest.Net.Collections" Version="14.906.1403.1082" />
    <PackageReference Include="Examine" Version="1.1.0" />
    <PackageReference Include="HtmlAgilityPack" Version="1.8.14" />
+    <PackageReference Include="HtmlSanitizer">
+      <Version>5.0.376</Version>
+    </PackageReference>
    <PackageReference Include="ImageProcessor">
      <Version>2.7.0.100</Version>
    </PackageReference>
@@ -1293,7 +1296,7 @@
    </PropertyGroup>
    <ItemGroup>
      <!-- we want to exclude all facade references ?! -->
-      <FixedReferencePath Include="@(ReferencePath)" Condition="'%(ReferencePath.FileName)' != 'System.ValueTuple' and '%(ReferencePath.FileName)' != 'System.Net.Http'" />
+      <FixedReferencePath Include="@(ReferencePath)" Condition="'%(ReferencePath.FileName)' != 'System.ValueTuple' and '%(ReferencePath.FileName)' != 'System.Net.Http' and '%(ReferencePath.FileName)' != 'System.Text.Encoding.CodePages'" />
    </ItemGroup>
    <Delete Files="$(TargetDir)$(TargetName).XmlSerializers.dll" ContinueOnError="true" />
    <!--
@@ -1303,4 +1306,4 @@
      <Output TaskParameter="SerializationAssembly" ItemName="SerializationAssembly" />
    </SGen>
  </Target>
-</Project>
+</Project>