-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #8 from backdrop/1.x
Update
- Loading branch information
Showing
77 changed files
with
1,612 additions
and
357 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,7 +9,9 @@ Backdrop aims to provide: | |
|
|
||
| Requirements | ||
| ------------ | ||
| - PHP 5.3.2 or higher. Even if Backdrop can run on older versions of PHP, we strongly recommend that you use a [supported version of PHP](https://secure.php.net/supported-versions.php). | ||
| - PHP 5.3.2 or higher. Even if Backdrop can run on older versions of PHP, we | ||
| strongly recommend that you use a | ||
| [supported version of PHP](https://secure.php.net/supported-versions.php). | ||
| - MySQL 5.0.15 or higher with PDO enabled | ||
| - Apache (recommended) or Nginx web server | ||
| - 50 MB of disk space (recommended), 15 MB (minimum) | ||
|
|
@@ -38,9 +40,10 @@ Security Issues | |
| --------------- | ||
| If you have discovered a security issue with Backdrop CMS or any of its | ||
| [contributed modules](https://github.com/backdrop-contrib/), please contact the | ||
| Backdrop Security Team directly at [[email protected]](mailto:[email protected]). | ||
| We manage security issues separately in a private repository until the issue | ||
| has been resolved. Even if you're not sure if it's a security problem, please | ||
| Backdrop Security Team directly at | ||
| [[email protected]](mailto:[email protected]). | ||
| We manage security issues separately in a private repository until the issue has | ||
| been resolved. Even if you're not sure if it's a security problem, please | ||
| contact the security team before filing an issue. | ||
|
|
||
| Developers | ||
|
|
@@ -84,5 +87,5 @@ All Backdrop code is Copyright 2001 - 2016 by the original authors. | |
|
|
||
| Backdrop also includes works under different copyright notices that are | ||
| distributed according to the terms of the GNU General Public License or a | ||
| compatible license. These individual works may have specific copyright | ||
| compatible license. These individual works may have specific copyright | ||
| information noted within their source code files or directories. | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,122 @@ | ||
| /** | ||
| * For jQuery versions less than 3.5.0, this replaces the jQuery.htmlPrefilter() | ||
| * function with one that fixes these security vulnerabilities while also | ||
| * retaining the pre-3.5.0 behavior where it's safe to do so. | ||
| * - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 | ||
| * - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023 | ||
| * | ||
| * Backdrop includes jQuery 1.12.4, the last stable version in the 1.x branch. | ||
| * This incorporates only the fix needed for that version, and so is simpler | ||
| * than the respective port for Drupal 7. | ||
| */ | ||
|
|
||
| (function (jQuery) { | ||
|
|
||
| // Parts of this backport differ by jQuery version. | ||
| var versionParts = jQuery.fn.jquery.split('.'); | ||
| var majorVersion = parseInt(versionParts[0]); | ||
| var minorVersion = parseInt(versionParts[1]); | ||
|
|
||
| // No backport is needed if we're already on jQuery 3.5 or higher. | ||
| if ( (majorVersion > 3) || (majorVersion === 3 && minorVersion >= 5) ) { | ||
| return; | ||
| } | ||
|
|
||
| // Prior to jQuery 3.5, jQuery converted XHTML-style self-closing tags to | ||
| // their XML equivalent: e.g., "<div />" to "<div></div>". This is | ||
| // problematic for several reasons, including that it's vulnerable to XSS | ||
| // attacks. However, since this was jQuery's behavior for many years, many | ||
| // Drupal modules and jQuery plugins may be relying on it. Therefore, we | ||
| // preserve that behavior, but for a limited set of tags only, that we believe | ||
| // to not be vulnerable. This is the set of HTML tags that satisfy all of the | ||
| // following conditions: | ||
| // - In DOMPurify's list of HTML tags. If an HTML tag isn't safe enough to | ||
| // appear in that list, then we don't want to mess with it here either. | ||
| // @see https://github.com/cure53/DOMPurify/blob/2.0.11/dist/purify.js#L128 | ||
| // - A normal element (not a void, template, text, or foreign element). | ||
| // @see https://html.spec.whatwg.org/multipage/syntax.html#elements-2 | ||
| // - An element that is still defined by the current HTML specification | ||
| // (not a deprecated element), because we do not want to rely on how | ||
| // browsers parse deprecated elements. | ||
| // @see https://developer.mozilla.org/en-US/docs/Web/HTML/Element | ||
| // - Not 'html', 'head', or 'body', because this pseudo-XHTML expansion is | ||
| // designed for fragments, not entire documents. | ||
| // - Not 'colgroup', because due to an idiosyncrasy of jQuery's original | ||
| // regular expression, it didn't match on colgroup, and we don't want to | ||
| // introduce a behavior change for that. | ||
| var selfClosingTagsToReplace = [ | ||
| 'a', 'abbr', 'address', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', | ||
| 'blockquote', 'button', 'canvas', 'caption', 'cite', 'code', 'data', | ||
| 'datalist', 'dd', 'del', 'details', 'dfn', 'div', 'dl', 'dt', 'em', | ||
| 'fieldset', 'figcaption', 'figure', 'footer', 'form', 'h1', 'h2', 'h3', | ||
| 'h4', 'h5', 'h6', 'header', 'hgroup', 'i', 'ins', 'kbd', 'label', 'legend', | ||
| 'li', 'main', 'map', 'mark', 'menu', 'meter', 'nav', 'ol', 'optgroup', | ||
| 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', | ||
| 'ruby', 's', 'samp', 'section', 'select', 'small', 'source', 'span', | ||
| 'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', | ||
| 'thead', 'time', 'tr', 'u', 'ul', 'var', 'video' | ||
| ]; | ||
|
|
||
| // Define regular expressions for <TAG/> and <TAG ATTRIBUTES/>. Doing this as | ||
| // two expressions makes it easier to target <a/> without also targeting | ||
| // every tag that starts with "a". | ||
| var xhtmlRegExpGroup = '(' + selfClosingTagsToReplace.join('|') + ')'; | ||
| var whitespace = '[\\x20\\t\\r\\n\\f]'; | ||
| var rxhtmlTagWithoutSpaceOrAttributes = new RegExp('<' + xhtmlRegExpGroup + '\\/>', 'gi'); | ||
| var rxhtmlTagWithSpaceAndMaybeAttributes = new RegExp('<' + xhtmlRegExpGroup + '(' + whitespace + '[^>]*)\\/>', 'gi'); | ||
|
|
||
| // jQuery 3.5 also fixed a vulnerability for when </select> appears within | ||
| // an <option> or <optgroup>, but it did that in local code that we can't | ||
| // backport directly. Instead, we filter such cases out. To do so, we need to | ||
| // determine when jQuery would otherwise invoke the vulnerable code, which it | ||
| // uses this regular expression to determine. The regular expression changed | ||
| // for version 3.0.0 and changed again for 3.4.0. | ||
| // @see https://github.com/jquery/jquery/blob/1.12.4/dist/jquery.js#L4432 | ||
| // @see https://github.com/jquery/jquery/blob/3.0.0/dist/jquery.js#L4584 | ||
| var rtagName; | ||
| if (majorVersion < 3) { | ||
| rtagName = /<([\w:]+)/; | ||
| } | ||
| else if (minorVersion < 4) { | ||
| rtagName = /<([a-z][^\/\0>\x20\t\r\n\f]+)/i; | ||
| } | ||
| else { | ||
| rtagName = /<([a-z][^\/\0>\x20\t\r\n\f]*)/i; | ||
| } | ||
|
|
||
| // The regular expression that jQuery uses to determine which self-closing | ||
| // tags to expand to open and close tags. This is vulnerable, because it | ||
| // matches all tag names except the few excluded ones. We only use this | ||
| // expression for determining vulnerability. The expression changed for | ||
| // version 3, but we only need to check for vulnerability in versions 1 and 2, | ||
| // so we use the expression from those versions. | ||
| // @see https://github.com/jquery/jquery/blob/1.12.4/dist/jquery.js#L5874 | ||
| var rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:-]+)[^>]*)\/>/gi; | ||
|
|
||
| jQuery.extend({ | ||
| htmlPrefilter: function (html) { | ||
| // This is how jQuery determines the first tag in the HTML. | ||
| // @see https://github.com/jquery/jquery/blob/1.12.4/dist/jquery.js#L6353 | ||
| var tag = ( rtagName.exec( html ) || [ "", "" ] )[ 1 ].toLowerCase(); | ||
|
|
||
| // It is not valid HTML for <option> or <optgroup> to have <select> as | ||
| // either a descendant or sibling, and attempts to inject one can cause | ||
| // XSS on jQuery versions before 3.5. Since this is invalid HTML and a | ||
| // possible XSS attack, reject the entire string. | ||
| // @see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023 | ||
| if ((tag === 'option' || tag === 'optgroup') && html.match(/<\/?select/i)) { | ||
| html = ''; | ||
| } | ||
|
|
||
| // Retain jQuery's prior to 3.5 conversion of pseudo-XHTML, but for only | ||
| // the tags in the `selfClosingTagsToReplace` list defined above. | ||
| // @see https://github.com/jquery/jquery/blob/1.12.4/dist/jquery.js#L6130 | ||
| // @see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 | ||
| html = html.replace(rxhtmlTagWithoutSpaceOrAttributes, "<$1></$1>"); | ||
| html = html.replace(rxhtmlTagWithSpaceAndMaybeAttributes, "<$1$2></$1>"); | ||
|
|
||
| return html; | ||
| } | ||
| }); | ||
|
|
||
| })(jQuery); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.