From 82406581afc4fa6e18051900434004d8563cf5c0 Mon Sep 17 00:00:00 2001 From: Ankit Agarwal Date: Thu, 12 Feb 2015 14:28:58 +0530 Subject: [PATCH] MDL-38466 filters: Redos protection and unit tests --- filter/urltolink/filter.php | 5 ++--- filter/urltolink/tests/filter_test.php | 17 ++++++++++++++++- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/filter/urltolink/filter.php b/filter/urltolink/filter.php index b9e5e14c54d..354dbe15c63 100644 --- a/filter/urltolink/filter.php +++ b/filter/urltolink/filter.php @@ -145,13 +145,12 @@ class filter_urltolink extends moodle_text_filter { } // Locate any HTML tags. - $matches = preg_split('/(<[^>]*>)/i', $text, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE); - $lookingforendstyle = false; + $matches = preg_split('/(<[^<|>]*>)/i', $text, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE); // Iterate through the tokenized text to handle chunks (html and content). foreach ($matches as $idx => $chunk) { // Nothing to do. We skip completely any html chunk. - if (strpos($chunk, '<') !== false) { + if (strpos(trim($chunk), '<') === 0) { continue; } diff --git a/filter/urltolink/tests/filter_test.php b/filter/urltolink/tests/filter_test.php index ee9c2c4b3c6..0ae7f891cff 100644 --- a/filter/urltolink/tests/filter_test.php +++ b/filter/urltolink/tests/filter_test.php @@ -29,7 +29,7 @@ global $CFG; require_once($CFG->dirroot . '/filter/urltolink/filter.php'); // Include the code to test -class filter_urltolink_testcase extends basic_testcase { +class filter_urltolink_filter_testcase extends basic_testcase { function get_convert_urls_into_links_test_cases() { // Create a 4095 and 4096 long URLs. @@ -159,6 +159,21 @@ class filter_urltolink_testcase extends basic_testcase { 'URL: ' . $superlong4096 => 'URL: ' . $superlong4096, // Testing URL within a span tag. 'URL: my link to http://google.com ' => 'URL: my link to http://google.com ', + // Nested tags test. + 'www.google.com' => 'www.google.com', + '' => '', + // Test realistic content. + '

Lorem ipsum amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut http://google.com aliquip ex ea commodo consequat. Duis aute irure in reprehenderit in excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia https://docs.google.com/document/d/BrokenLinkPleaseAyacDHc_Ov8aoskoSVQsfmLHP_jYAkRMk/edit?usp=sharing https://docs.google.com/document/d/BrokenLinkPleaseAyacDHc_Ov8aoskoSVQsfmLHP_jYAkRMk/edit?usp=sharing mollit anim id est laborum.

' + => + '

Lorem ipsum amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut http://google.com aliquip ex ea commodo consequat. Duis aute irure in reprehenderit in excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia https://docs.google.com/document/d/BrokenLinkPleaseAyacDHc_Ov8aoskoSVQsfmLHP_jYAkRMk/edit?usp=sharing https://docs.google.com/document/d/BrokenLinkPleaseAyacDHc_Ov8aoskoSVQsfmLHP_jYAkRMk/edit?usp=sharing mollit anim id est laborum.

', + // Test some broken html. + '5 < 10 www.google.com im a link' => '5 < 10 www.google.com im a link', + 'h3 (www.styles.com/h3) < h1 (www.styles.com/h1)' => 'h3 (www.styles.com/h3) < h1 (www.styles.com/h1)', + '

text www.moodle.org</p> text' => '

text www.moodle.org</p> text', + // Some more urls. + '' => '', + 'www.google.com' => 'www.google.com', + 'http://nolandforzombies.com Zombies FTW http://aliens.org' => 'http://nolandforzombies.com Zombies FTW http://aliens.org', //URLs in Javascript. Commented out as part of MDL-21183 //'var url="http://moodle.org";'=>'var url="http://moodle.org";', //'var url = "http://moodle.org";'=>'var url = "http://moodle.org";',