Skip to content

Commit 1b1dcdd

Browse files
Merge pull request #303 from thombashi/fix_cve-2018-5773
Fix CVE-2018-5773: #285
2 parents 9121c02 + 9fc2a37 commit 1b1dcdd

File tree

5 files changed

+17
-2
lines changed

5 files changed

+17
-2
lines changed

lib/markdown2.py

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1203,7 +1203,7 @@ def _is_auto_link(s):
12031203
self.html_spans[key] = sanitized
12041204
tokens.append(key)
12051205
else:
1206-
tokens.append(token)
1206+
tokens.append(self._encode_incomplete_tags(token))
12071207
is_html_markup = not is_html_markup
12081208
return ''.join(tokens)
12091209

@@ -2140,6 +2140,14 @@ def _encode_amps_and_angles(self, text):
21402140
text = self._naked_gt_re.sub('>', text)
21412141
return text
21422142

2143+
_incomplete_tags_re = re.compile("<(/?\w+\s+)")
2144+
2145+
def _encode_incomplete_tags(self, text):
2146+
if self.safe_mode not in ("replace", "escape"):
2147+
return text
2148+
2149+
return self._incomplete_tags_re.sub("&lt;\\1", text)
2150+
21432151
def _encode_backslash_escapes(self, text):
21442152
for ch, escape in list(self._escape_table.items()):
21452153
text = text.replace("\\"+ch, escape)

test/tm-cases/CVE-2018-5773.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<p>&lt;img src="" onerror=alert(/XSS/) </p>
2+
3+
<p>&lt;/img src="" onerror=alert(/XSS/) </p>

test/tm-cases/CVE-2018-5773.opts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"safe_mode": "replace"}

test/tm-cases/CVE-2018-5773.text

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<img src="" onerror=alert(/XSS/)
2+
3+
</img src="" onerror=alert(/XSS/)

test/tm-cases/basic_safe_mode.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828

2929
<p><img src="http://example.com&gt;[HTML_REMOVED]alert(1)[HTML_REMOVED]" alt="img3" /></p>
3030

31-
<p><img src="javascript:alert(1)"</p>
31+
<p>&lt;img src="javascript:alert(1)"</p>
3232

3333
<p><img src="http://example.com/image.gif?h=200&amp;w=500" alt="ok img" /></p>
3434

0 commit comments

Comments
 (0)