From 3a26fe8fe2fe115c957bcac03aafdd30e95f7f04 Mon Sep 17 00:00:00 2001
From: elitsa <elm@umbraco.dk>
Date: Mon, 3 Dec 2018 08:45:11 +0100
Subject: [PATCH] Removing malicious code from the name of a Stylesheet.

---
 src/Umbraco.Core/StringExtensions.cs              | 4 ++--
 src/Umbraco.Web/UI/LegacyDialogHandler.cs         | 2 +-
 src/Umbraco.Web/WebServices/SaveFileController.cs | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/Umbraco.Core/StringExtensions.cs b/src/Umbraco.Core/StringExtensions.cs
index c6b4da96eb..a0479e62f2 100644
--- a/src/Umbraco.Core/StringExtensions.cs
+++ b/src/Umbraco.Core/StringExtensions.cs
@@ -190,7 +190,7 @@ namespace Umbraco.Core
             return new string(outputArray);
         }
 
-        private static readonly char[] CleanForXssChars = "*?(){}[];:%<>/\\|&'\"".ToCharArray();
+        private static readonly char[] CleanForXssChars = "*?(){}[];:%<>/\\|&'+\"".ToCharArray();
 
         /// <summary>
         /// Cleans string to aid in preventing xss attacks.
@@ -541,7 +541,7 @@ namespace Umbraco.Core
         /// <returns>Returns the string without any html tags.</returns>
         public static string StripHtml(this string text)
         {
-            const string pattern = @"<(.|\n)*?>";
+            string pattern = "[*{}\\/:<>?|\"-+()\\n]";
             return Regex.Replace(text, pattern, String.Empty);
         }
 
diff --git a/src/Umbraco.Web/UI/LegacyDialogHandler.cs b/src/Umbraco.Web/UI/LegacyDialogHandler.cs
index efcea4bbd5..a3dc6750e9 100644
--- a/src/Umbraco.Web/UI/LegacyDialogHandler.cs
+++ b/src/Umbraco.Web/UI/LegacyDialogHandler.cs
@@ -207,7 +207,7 @@ namespace Umbraco.Web.UI
 
             typeInstance.TypeID = typeId;
             typeInstance.ParentID = nodeId;
-            typeInstance.Alias = text;
+            typeInstance.Alias = text.CleanForXss();
 
             // check for returning url
             ITaskReturnUrl returnUrlTask = typeInstance as LegacyDialogTask;
diff --git a/src/Umbraco.Web/WebServices/SaveFileController.cs b/src/Umbraco.Web/WebServices/SaveFileController.cs
index 5f2fcaeb34..359ee6fc31 100644
--- a/src/Umbraco.Web/WebServices/SaveFileController.cs
+++ b/src/Umbraco.Web/WebServices/SaveFileController.cs
@@ -243,7 +243,7 @@ namespace Umbraco.Web.WebServices
             // sanitize input - stylesheet names have no extension
             var svce = (FileService)Services.FileService;
 
-            filename = CleanFilename(filename);
+            filename = CleanFilename(filename.CleanForXss());
             oldName = CleanFilename(oldName);
 
             if (filename != oldName)