Changeset 14928

Timestamp:

2007/06/26 15:10:47 (16 years ago)

Author:

adati

Message:

XSS:置換候補に「javascript:」を追加

File:

• branches/rel/data/smarty_extends/modifier.script_escape.php (modified) (1 diff)

branches/rel/data/smarty_extends/modifier.script_escape.php

@@ -8 +8 @@
 function smarty_modifier_script_escape($value) {
     
-    if (is_array($value)) {return $value;}
+    if (is_array($value)) return $value;
     
-    $pattern = "/<script.*?>|<\/script>/";
-    $convert = "#####";
+    $pattern = "/<script.*?>|<\/script>|javascript:/";
+    $convert = "#script tag escaped#";
     
     if ( preg_match_all($pattern, $value, $matches) ) {