yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3818 from umbraco/temp7-268-xss-xslt

Browse Source 
Fixing XSS issue with Xslt files.
This commit is contained in:
Shannon Deminick
2018-12-17 15:20:36 +11:00
committed by GitHub
parent 518f5137e6 ae8e20546f
commit fde64f157c
4 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Umbraco.Web/umbraco.presentation/umbraco/create/XsltTasks.cs
View File

@@ -28,7 +28,7 @@ namespace umbraco
IOHelper.EnsureFileExists(Path.Combine(IOHelper.MapPath(SystemDirectories.Xslt), "web.config"), Files.BlockingWebConfig);
var template = Alias.Substring(0, Alias.IndexOf("|||"));
var fileName = Alias.Substring(Alias.IndexOf("|||") + 3, Alias.Length - Alias.IndexOf("|||") - 3).Replace(" ", "");
var fileName = Alias.Substring(Alias.IndexOf("|||") + 3, Alias.Length - Alias.IndexOf("|||") - 3);
if (fileName.ToLowerInvariant().EndsWith(".xslt") == false)
fileName += ".xslt";
var xsltTemplateSource = IOHelper.MapPath(SystemDirectories.Umbraco + "/xslt/templates/" + template);

2
src/Umbraco.Web/umbraco.presentation/umbraco/create/xslt.ascx.cs
View File

@@ -66,7 +66,7 @@ namespace umbraco.presentation.create
BasePage.Current.getUser(),
helper.Request("nodeType"),
createMacroVal,
xsltName + "|||" + rename.Text);
xsltName + "|||" + rename.Text.CleanForXss());
BasePage.Current.ClientTools
.ChangeContentFrameUrl(returnUrl)

2
src/Umbraco.Web/umbraco.presentation/umbraco/developer/Xslt/editXslt.aspx.cs
View File

@@ -97,7 +97,7 @@ namespace umbraco.cms.presentation.developer
// Add source and filename
var file = IOHelper.MapPath(SystemDirectories.Xslt + "/" + Request.QueryString["file"]);
var file = IOHelper.MapPath(SystemDirectories.Xslt + "/" + Request.QueryString["file"].CleanForXss().Replace(" ", ""));
// validate file
IOHelper.ValidateEditPath(file, SystemDirectories.Xslt);

4
src/Umbraco.Web/umbraco.presentation/umbraco/webservices/codeEditorSave.asmx.cs
View File

@@ -61,6 +61,8 @@ namespace umbraco.presentation.webservices
[WebMethod]
public string SaveXslt(string fileName, string oldName, string fileContents, bool ignoreDebugging)
{
fileName = fileName.CleanForXss();
if (AuthorizeRequest(DefaultApps.developer.ToString()))
{
IOHelper.EnsurePathExists(SystemDirectories.Xslt);
@@ -448,4 +450,4 @@ namespace umbraco.presentation.webservices
}
}
}
}