/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ /* vim: set ts=8 sts=2 et sw=2 tw=80: */ /* This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this http://mozilla.org/MPL/2.0/. */ #include "nsTreeSanitizer.h" #include "mozilla/Algorithm.h" #include "mozilla/ArrayUtils.h" #include "mozilla/DeclarationBlock.h" #include "mozilla/StaticPrefs_dom.h" #include "mozilla/StyleSheetInlines.h" #include "mozilla/dom/DocumentFragment.h" #include "mozilla/dom/HTMLFormElement.h" #include "mozilla/dom/HTMLTemplateElement.h" #include "mozilla/dom/HTMLUnknownElement.h" #include "mozilla/dom/Link.h" #include "mozilla/dom/SanitizerBinding.h" #include "mozilla/dom/ShadowIncludingTreeIterator.h" #include "mozilla/dom/SRIMetadata.h" #include "mozilla/NullPrincipal.h" #include "nsAtom.h" #include "nsCSSPropertyID.h" #include "nsHashtablesFwd.h" #include "nsString.h" #include "nsTHashtable.h" #include "nsUnicharInputStream.h" #include "nsAttrName.h" #include "nsIScriptError.h" #include "nsIScriptSecurityManager.h" #include "nsNameSpaceManager.h" #include "nsNetUtil.h" #include "nsComponentManagerUtils.h" #include "nsContentUtils.h" #include "nsIParserUtils.h" #include "mozilla/dom/Document.h" #include "nsQueryObject.h" #include <iterator>using namespace mozilla;using namespace mozilla::dom;// // Thanks to Mark Pilgrim and Sam Ruby for the initial whitelist // const nsStaticAtom* const kElementsHTML[] = {// clang-format off // body checked specially // head checked specially // html checked specially // style checked specially // template checked and traversed specially // title checked specially // clang-format on const nsStaticAtom* const kAttributesHTML[] = {// clang-format off char ,class ,for ,// clang-format on const nsStaticAtom* const kPresAttributesHTML[] = {// clang-format off // clang-format on // List of HTML attributes with URLs that the // browser will fetch. Should be kept in sync with // https://html.spec.whatwg.org/multipage/indices.html#attributes-3 const nsStaticAtom* const kURLAttributesHTML[] = {// clang-format off // clang-format on const nsStaticAtom* const kElementsSVG[] = {// a // circle // clipPath // color-profile // cursor // defs // desc // discard // ellipse // elevation // erode // ex // exact // exponent // feBlend // feColorMatrix // feComponentTransfer // feComposite // feConvolveMatrix // feDiffuseLighting // feDisplacementMap // feDistantLight // feDropShadow // feFlood // feFuncA // feFuncB // feFuncG // feFuncR // feGaussianBlur // feImage // feMerge // feMergeNode // feMorphology // feOffset // fePointLight // feSpecularLighting // feSpotLight // feTile // feTurbulence // filter // font // font-face // font-face-format // font-face-name // font-face-src // font-face-uri // foreignObject // g // glyph // glyphRef // hkern // image // line // linearGradient // marker // mask // metadata // missingGlyph // mpath // path // pattern // polygon // polyline // radialGradient // rect // stop // svg // switch // symbol // text // textPath // title // tref // tspan // use // view // vkern const nsStaticAtom* const kAttributesSVG[] = {// accent-height // accumulate // additive // alignment-baseline // alphabetic // amplitude // arabic-form // ascent // attributeName // attributeType // azimuth // baseFrequency // baseline-shift // baseProfile // bbox // begin // bias // by // calcMode // cap-height class , // class // clip-path // clip-rule // clipPathUnits // color // color-interpolation // color-interpolation-filters // cursor // cx // cy // d // descent // diffuseConstant // direction // display // divisor // dominant-baseline // dur // dx // dy // edgeMode // elevation // enable-background // end // fill // fill-opacity // fill-rule // filter // filterUnits // flood-color // flood-opacity // XXX focusable // font // font-family // font-size // font-size-adjust // font-stretch // font-style // font-variant // font-weight // format // from // fx // fy // g1 // g2 // glyph-name // glyphRef // glyph-orientation-horizontal // glyph-orientation-vertical // gradientTransform // gradientUnits // height // horiz-adv-x // horiz-origin-x // horiz-origin-y // id // ideographic // image-rendering // in // in2 // intercept // k // k1 // k2 // k3 // k4 // kerning // kernelMatrix // kernelUnitLength // keyPoints // keySplines // keyTimes // lang // lengthAdjust // letter-spacing // lighting-color // limitingConeAngle // local // marker // marker-end // marker-mid // marker-start // markerHeight // markerUnits // markerWidth // mask // maskContentUnits // maskUnits // mathematical // max // media // method // min // mode // name // numOctaves // offset // opacity operator , // operator // order // orient // orientation // origin // overline-position // overline-thickness // overflow // panose-1 // path // pathLength // patternContentUnits // patternTransform // patternUnits // pointer-events XXX is this safe? // points // pointsAtX // pointsAtY // pointsAtZ // preserveAlpha // preserveAspectRatio // primitiveUnits // r // radius // refX // refY // repeatCount // repeatDur // requiredExtensions // requiredFeatures // restart // result // rotate // rx // ry // scale // seed // shape-rendering // slope // spacing // specularConstant // specularExponent // spreadMethod // startOffset // stdDeviation // stemh // stemv // stitchTiles // stop-color // stop-opacity // strikethrough-position // strikethrough-thickness // string // stroke // stroke-dasharray // stroke-dashoffset // stroke-linecap // stroke-linejoin // stroke-miterlimit // stroke-opacity // stroke-width // surfaceScale // systemLanguage // tableValues // target // targetX // targetY // text-anchor // text-decoration // textLength // text-rendering // title // to // transform // transform-origin // type // u1 // u2 // underline-position // underline-thickness // unicode // unicode-bidi // unicode-range // units-per-em // v-alphabetic // v-hanging // v-ideographic // v-mathematical // values // vector-effect // vert-adv-y // vert-origin-x // vert-origin-y // viewBox // viewTarget // visibility // width // widths // word-spacing // writing-mode // x // x-height // x1 // x2 // xChannelSelector // y // y1 // y2 // yChannelSelector // z // zoomAndPan const nsStaticAtom* const kURLAttributesSVG[] = {nsGkAtoms::href,auto aURLAttributeSVG) {return AnyOf(std::begin(kAttributesSVG),auto aAttributeSVG) {return aAttributeSVG == aURLAttributeSVG;const nsStaticAtom* const kElementsMathML[] = {// abs and , // and // annotation // annotation-xml // apply // approx // arccos // arccosh // arccot // arccoth // arccsc // arccsch // arcsec // arcsech // arcsin // arcsinh // arctan // arctanh // arg // bind // bvar // card // cartesianproduct // cbytes // ceiling // cerror // ci // cn // codomain // complexes // compose // condition // conjugate // cos // cosh // cot // coth // cs // csc // csch // csymbol // curl // declare // degree // determinant // diff // divergence // divide // domain // domainofapplication // el // emptyset // eq // equivalent // eulergamma // exists // exp // exponentiale // factorial // factorof false , // false // floor // fn // forall // gcd // geq // grad // gt // ident // image // imaginary // imaginaryi // implies // in // infinity // int // integers // intersect // interval // inverse // lambda // laplacian // lcm // leq // limit // list // ln // log // logbase // lowlimit // lt // maction // maligngroup // malignmark // math // matrix // matrixrow // max // mean // median // menclose // merror // mfrac // mglyph // mi // min // minus // mlabeledtr // mlongdiv // mmultiscripts // mn // mo // mode // moment // momentabout // mover // mpadded // mphantom // mprescripts // mroot // mrow // ms // mscarries // mscarry // msgroup // msline // mspace // msqrt // msrow // mstack // mstyle // msub // msubsup // msup // mtable // mtd // mtext // mtr // munder // munderover // naturalnumbers // neq // none not , // not // notanumber // note // notin // notprsubset // notsubset or , // or // otherwise // outerproduct // partialdiff // pi // piece // piecewise // plus // power // primes // product // prsubset // quotient // rationals // real // reals // reln // rem // root // scalarproduct // sdev // sec // sech // selector // semantics // sep // set // setdiff // share // sin // sinh // subset // sum // tan // tanh // tendsto // times // transpose true , // true // union // uplimit // variance // vector // vectorproduct // xor const nsStaticAtom* const kAttributesMathML[] = {// accent // accentunder // actiontype // align // alignmentscope // alt // altimg // altimg-height // altimg-valign // altimg-width // background // base // bevelled // cd // cdgroup // charalign // close // closure // color // columnalign // columnalignment // columnlines // columnspacing // columnspan // columnwidth // crossout // decimalpoint // definitionURL // denomalign // depth // dir // display // displaystyle // edge // encoding // equalcolumns // equalrows // fence // fontfamily // fontsize // fontstyle // fontweight // form // frame // framespacing // groupalign // height // href // id // indentalign // indentalignfirst // indentalignlast // indentshift // indentshiftfirst // indenttarget // index // integer // largeop // length // linebreak // linebreakmultchar // linebreakstyle // linethickness // location // longdivstyle // lquote // lspace // ltr // mathbackground // mathcolor // mathsize // mathvariant // maxsize // minlabelspacing // minsize // movablelimits // msgroup // name // newline // notation // numalign // number // open // order // other // overflow // position // role // rowalign // rowlines // rowspacing // rowspan // rquote // rspace // schemaLocation // scriptlevel // scriptminsize // scriptsize // scriptsizemultiplier // selection // separator // separators // shift // side // src // stackalign // stretchy // subscriptshift // superscriptshift // symmetric // type // voffset // width // xref const nsStaticAtom* const kURLAttributesMathML[] = {// clang-format off // clang-format on // https://wicg.github.io/sanitizer-api/#baseline-attribute-allow-list const nsStaticAtom* const kBaselineAttributeAllowlist[] = {// clang-format off // nsGkAtoms::allowpaymentrequest, // nsGkAtoms::autocorrect, // nsGkAtoms::autopictureinpicture, // nsGkAtoms::challenge, char ,class ,// nsGkAtoms::controlslist, // nsGkAtoms::conversiondestination, default ,// nsGkAtoms::dirname, // nsGkAtoms::disablepictureinpicture, // nsGkAtoms::disableremoteplayback, // nsGkAtoms::disallowdocumentaccess, // nsGkAtoms::elementtiming, for ,// nsGkAtoms::hreftranslate, // nsGkAtoms::equiv, // nsGkAtoms::importance, // nsGkAtoms::impressiondata, // nsGkAtoms::impressionexpiry, // nsGkAtoms::incremental, // nsGkAtoms::invisible, // nsGkAtoms::keytype, // nsGkAtoms::latencyhint, // nsGkAtoms::list, // nsGkAtoms::mayscript, // nsGkAtoms::playsinline, // nsGkAtoms::policy, // nsGkAtoms::pseudo, // nsGkAtoms::reportingorigin, // nsGkAtoms::scopes, // nsGkAtoms::shadowroot, // nsGkAtoms::shadowrootdelegatesfocus, // nsGkAtoms::trusttoken, // nsGkAtoms::virtualkeyboardpolicy, // clang-format on // https://wicg.github.io/sanitizer-api/#baseline-elements const nsStaticAtom* const kBaselineElementAllowlist[] = {template , nsGkAtoms::textarea,// https://wicg.github.io/sanitizer-api/#default-configuration // default configuration's attribute allow list. // Note: Currently all listed attributes are allowed for every element // (e.g. they use "*"). // Compared to kBaselineAttributeAllowlist only deprecated allowpaymentrequest // attribute is missing. const nsStaticAtom* const kDefaultConfigurationAttributeAllowlist[] =// nsGkAtoms::autocorrect, // nsGkAtoms::autopictureinpicture, // nsGkAtoms::challenge, char ,class ,// nsGkAtoms::controlslist, // nsGkAtoms::conversiondestination, default ,// nsGkAtoms::dirname, // nsGkAtoms::disablepictureinpicture, // nsGkAtoms::disableremoteplayback, // nsGkAtoms::disallowdocumentaccess, // nsGkAtoms::elementtiming, for ,// nsGkAtoms::hreftranslate, // nsGkAtoms::equiv, // nsGkAtoms::importance, // nsGkAtoms::impressiondata, // nsGkAtoms::impressionexpiry, // nsGkAtoms::incremental, // nsGkAtoms::invisible, // nsGkAtoms::keytype, // nsGkAtoms::latencyhint, // nsGkAtoms::list, // nsGkAtoms::mayscript, // nsGkAtoms::playsinline, // nsGkAtoms::policy, // nsGkAtoms::pseudo, // nsGkAtoms::reportingorigin, // nsGkAtoms::scopes, // nsGkAtoms::shadowroot, // nsGkAtoms::shadowrootdelegatesfocus, // nsGkAtoms::trusttoken, // nsGkAtoms::virtualkeyboardpolicy, // https://wicg.github.io/sanitizer-api/#default-configuration // default configuration's element allow list. const nsStaticAtom* const kDefaultConfigurationElementAllowlist[] = {false ),if (mCidEmbedsOnly) {// Sanitizing styles for external references is not supported. false ;if (!sElementsHTML) {// Initialize lazily to avoid having to initialize at all if the user // doesn't paste HTML or load feeds. bool nsTreeSanitizer::MustFlatten(int32_t aNamespace, nsAtom* aLocal) {if (mIsForSanitizerAPI) {return MustFlattenForSanitizerAPI(aNamespace, aLocal);if (aNamespace == kNameSpaceID_XHTML) {if (mDropNonCSSPresentation &&return true ;if (mDropForms &&return true ;if (mFullDocument &&return false ;if (nsGkAtoms::_template == aLocal) {return false ;return !sElementsHTML->Contains(aLocal);if (aNamespace == kNameSpaceID_SVG) {if (mCidEmbedsOnly || mDropMedia) {// Sanitizing CSS-based URL references inside SVG presentational // attributes is not supported, so flattening for cid: embed case. return true ;return !sElementsSVG->Contains(aLocal);if (aNamespace == kNameSpaceID_MathML) {return !sElementsMathML->Contains(aLocal);return true ;bool nsTreeSanitizer::MustFlattenForSanitizerAPI(int32_t aNamespace,// This implements everything in // https://wicg.github.io/sanitizer-api/#sanitize-action-for-an-element that // is supposed to be blocked. // Step 6. If element matches any name in config["blockElements"]: Return // block. if (mReplaceWithChildrenElements &&return true ;// Step 7. Let allow list be null. // Step 8. If "allowElements" exists in config: // Step 8.1. Then : Set allow list to config["allowElements"]. if (mElements) {// Step 9. If element does not match any name in allow list: // Return block. if (!mElements->Contains(ElementName(aNamespace, aLocal))) {return true ;else {// Step 8.2. Otherwise: Set allow list to the default configuration's // element allow list. // Step 9. If element does not match any name in allow list: // Return block. // The default configuration only contains HTML elements, so we can // reject everything else. if (aNamespace != kNameSpaceID_XHTML ||return true ;// Step 10. Return keep. return false ;bool nsTreeSanitizer::IsURL(const nsStaticAtom* const * aURLs,const nsStaticAtom* atom;while ((atom = *aURLs)) {if (atom == aLocalName) {return true ;return false ;bool nsTreeSanitizer::MustPrune(int32_t aNamespace, nsAtom* aLocal,if (mIsForSanitizerAPI) {return MustPruneForSanitizerAPI(aNamespace, aLocal, aElement);// To avoid attacks where a MathML script becomes something that gets // serialized in a way that it parses back as an HTML script, let's just // drop elements with the local name 'script' regardless of namespace. if (nsGkAtoms::script == aLocal) {return true ;if (aNamespace == kNameSpaceID_XHTML) {if (nsGkAtoms::title == aLocal && !mFullDocument) {// emulate the quirks of the old parser return true ;if (mDropForms &&return true ;if (mDropMedia &&return true ;if (nsGkAtoms::meta == aLocal &&// Throw away charset declarations even if they also have microdata // which they can't validly have. return true ;if (((!mFullDocument && nsGkAtoms::meta == aLocal) ||// emulate old behavior for non-Microdata <meta> and <link> presumably // in <head>. <meta> and <link> are whitelisted in order to avoid // corrupting Microdata when they appear in <body>. Note that // SanitizeAttributes() will remove the rel attribute from <link> and // the name attribute from <meta>. return true ;if (mAllowStyles) {return nsGkAtoms::style == aLocal && !(aNamespace == kNameSpaceID_XHTML ||if (nsGkAtoms::style == aLocal) {return true ;return false ;enum class ElementKind {// https://wicg.github.io/sanitizer-api/#element-kind static ElementKind GetElementKind(int32_t aNamespace, nsAtom* aLocal,// XXX(bug 1782926) The spec for this is known to be wrong. // https://github.com/WICG/sanitizer-api/issues/147 // custom, if element’s local name is a valid custom element name, // XXX shouldn't this happen after unknown. if (nsContentUtils::IsCustomElementName(aLocal, kNameSpaceID_XHTML)) {return ElementKind::Custom;// unknown, if element is not in the [HTML] namespace // XXX this doesn't really make sense to me // https://github.com/WICG/sanitizer-api/issues/167 if (aNamespace != kNameSpaceID_XHTML) {return ElementKind::Unknown;// or if element’s local name denotes an unknown element // — that is, if the element interface the [HTML] specification assigns to it // would be HTMLUnknownElement, if (nsCOMPtr<HTMLUnknownElement> el = do_QueryInterface(aElement)) {return ElementKind::Unknown;// regular, otherwise. return ElementKind::Regular;bool nsTreeSanitizer::MustPruneForSanitizerAPI(int32_t aNamespace,// This implements everything in // https://wicg.github.io/sanitizer-api/#sanitize-action-for-an-element that // is supposed to be dropped. // Step 1. Let kind be element’s element kind. switch (kind) {case ElementKind::Regular:// Step 2. If kind is regular and element does not match any name in the // baseline element allow list: Return drop. if (!sBaselineElementAllowlist->Contains(aLocal)) {return true ;break ;case ElementKind::Custom:// Step 3. If kind is custom and if config["allowCustomElements"] does not // exist or if config["allowCustomElements"] is false: Return drop. if (!mAllowCustomElements) {return true ;break ;case ElementKind::Unknown:// Step 4. If kind is unknown and if config["allowUnknownMarkup"] does not // exist or it config["allowUnknownMarkup"] is false: Return drop. if (!mAllowUnknownMarkup) {return true ;break ;// Step 5. If element matches any name in config["dropElements"]: Return drop. if (mRemoveElements &&return true ;return false ;/** * Parses a style sheet and reserializes it with unsafe styles removed. * * @param aOriginal the original style sheet source * @param aSanitized the reserialization without dangerous CSS. * @param aDocument the document the style sheet belongs to * @param aBaseURI the base URI to use * @param aSanitizationKind the kind of style sanitization to use. static void SanitizeStyleSheet(const nsAString& aOriginal,auto extraData =/* loader = */ nullptr, /* stylesheet = */ nullptr, /* load_data = */ nullptr, &style, /* reusable_sheets = */ nullptr, /* use_counters = */ nullptr, StyleAllowImportRules::Yes, bool nsTreeSanitizer::SanitizeInlineStyle(false , styleText);true );return sanitizedStyle.Length() != styleText.Length();quality 96%
¤ Dauer der Verarbeitung: 0.28 Sekunden
(vorverarbeitet)
¤ *© Formatika GbR, Deutschland
