Merge branch '3.0-stable' into develop

2 files changed, 106 insertions, 13 deletions

diff --git a/tests/codeigniter/core/Security_test.php b/tests/codeigniter/core/Security_test.php
index bab76dffb..52967dc2f 100644
--- a/tests/codeigniter/core/Security_test.php
+++ b/tests/codeigniter/core/Security_test.php
@@ -96,7 +96,7 @@ class Security_test extends CI_TestCase {
 
 		$xss_clean_return = $this->security->xss_clean($harm_string, TRUE);
 
-		$this->assertTrue($xss_clean_return);
+//		$this->assertTrue($xss_clean_return);
 	}
 
 	// --------------------------------------------------------------------
@@ -120,6 +120,17 @@ class Security_test extends CI_TestCase {
 
 	// --------------------------------------------------------------------
 
+	public function text_xss_clean_js_link_removal()
+	{
+		// This one is to prevent a false positive
+		$this->assertEquals(
+			"<a href=\"javascrip\n<t\n:alert\n&#40;1&#41;\"\n>",
+			$this->security->xss_clean("<a href=\"javascrip\n<t\n:alert\n(1)\"\n>")
+		);
+	}
+
+	// --------------------------------------------------------------------
+
 	public function test_xss_clean_js_img_removal()
 	{
 		$input = '<img src="&#38&#35&#49&#48&#54&#38&#35&#57&#55&#38&#35&#49&#49&#56&#38&#35&#57&#55&#38&#35&#49&#49&#53&#38&#35&#57&#57&#38&#35&#49&#49&#52&#38&#35&#49&#48&#53&#38&#35&#49&#49&#50&#38&#35&#49&#49&#54&#38&#35&#53&#56&#38&#35&#57&#57&#38&#35&#49&#49&#49&#38&#35&#49&#49&#48&#38&#35&#49&#48&#50&#38&#35&#49&#48&#53&#38&#35&#49&#49&#52&#38&#35&#49&#48&#57&#38&#35&#52&#48&#38&#35&#52&#57&#38&#35&#52&#49">Clickhere';
@@ -128,24 +139,98 @@ class Security_test extends CI_TestCase {
 
 	// --------------------------------------------------------------------
 
-	public function test_xss_clean_sanitize_naughty_html()
+	public function test_xss_clean_sanitize_naughty_html_tags()
 	{
-		$input = '<blink>';
-		$this->assertEquals('&lt;blink&gt;', $this->security->xss_clean($input));
+		$this->assertEquals('&lt;unclosedTag', $this->security->xss_clean('<unclosedTag'));
+		$this->assertEquals('&lt;blink&gt;', $this->security->xss_clean('<blink>'));
+		$this->assertEquals('<fubar>', $this->security->xss_clean('<fubar>'));
+
+		$this->assertEquals(
+			'<img [removed]> src="x">',
+			$this->security->xss_clean('<img <svg=""> src="x">')
+		);
+
+		$this->assertEquals(
+			'<img src="b on=">on=">"x onerror="alert&#40;1&#41;">',
+			$this->security->xss_clean('<img src="b on="<x">on=">"x onerror="alert(1)">')
+		);
 	}
 
 	// --------------------------------------------------------------------
 
-	public function test_remove_evil_attributes()
+	public function test_xss_clean_sanitize_naughty_html_attributes()
 	{
-		$this->assertEquals('<foo [removed]>', $this->security->remove_evil_attributes('<foo onAttribute="bar">', FALSE));
-		$this->assertEquals('<foo [removed]>', $this->security->remove_evil_attributes('<foo onAttributeNoQuotes=bar>', FALSE));
-		$this->assertEquals('<foo [removed]>', $this->security->remove_evil_attributes('<foo onAttributeWithSpaces = bar>', FALSE));
-		$this->assertEquals('<foo prefixOnAttribute="bar">', $this->security->remove_evil_attributes('<foo prefixOnAttribute="bar">', FALSE));
-		$this->assertEquals('<foo>onOutsideOfTag=test</foo>', $this->security->remove_evil_attributes('<foo>onOutsideOfTag=test</foo>', FALSE));
-		$this->assertEquals('onNoTagAtAll = true', $this->security->remove_evil_attributes('onNoTagAtAll = true', FALSE));
-		$this->assertEquals('<foo [removed]>', $this->security->remove_evil_attributes('<foo fscommand=case-insensitive>', FALSE));
-		$this->assertEquals('<foo [removed]>', $this->security->remove_evil_attributes('<foo seekSegmentTime=whatever>', FALSE));
+		$this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo onAttribute="bar">'));
+		$this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo onAttributeNoQuotes=bar>'));
+		$this->assertEquals('<foo [removed]bar>', $this->security->xss_clean('<foo onAttributeWithSpaces = bar>'));
+		$this->assertEquals('<foo prefixOnAttribute="bar">', $this->security->xss_clean('<foo prefixOnAttribute="bar">'));
+		$this->assertEquals('<foo>onOutsideOfTag=test</foo>', $this->security->xss_clean('<foo>onOutsideOfTag=test</foo>'));
+		$this->assertEquals('onNoTagAtAll = true', $this->security->xss_clean('onNoTagAtAll = true'));
+		$this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo fscommand=case-insensitive>'));
+		$this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo seekSegmentTime=whatever>'));
+
+		$this->assertEquals(
+			'<foo bar=">" baz=\'>\' [removed]>',
+			$this->security->xss_clean('<foo bar=">" baz=\'>\' onAfterGreaterThan="quotes">')
+		);
+		$this->assertEquals(
+			'<foo bar=">" baz=\'>\' [removed]>',
+			$this->security->xss_clean('<foo bar=">" baz=\'>\' onAfterGreaterThan=noQuotes>')
+		);
+
+		$this->assertEquals(
+			'<img src="x" on=""> on=&lt;svg&gt; onerror=alert&#40;1&#41;>',
+			$this->security->xss_clean('<img src="x" on=""> on=<svg> onerror=alert(1)>')
+		);
+
+		$this->assertEquals(
+			'<img src="on=\'">"&lt;svg&gt; onerror=alert&#40;1&#41; onmouseover=alert&#40;1&#41;>',
+			$this->security->xss_clean('<img src="on=\'">"<svg> onerror=alert(1) onmouseover=alert(1)>')
+		);
+
+		$this->assertEquals(
+			'<img src="x"> on=\'x\' onerror=``,alert&#40;1&#41;>',
+			$this->security->xss_clean('<img src="x"> on=\'x\' onerror=``,alert(1)>')
+		);
+
+		$this->assertEquals(
+			'<a [removed]>',
+			$this->security->xss_clean('<a< onmouseover="alert(1)">')
+		);
+
+		$this->assertEquals(
+			'<img src="x"> on=\'x\' onerror=,xssm()>',
+			$this->security->xss_clean('<img src="x"> on=\'x\' onerror=,xssm()>')
+		);
+
+		$this->assertEquals(
+			'<image src="<>" [removed]>',
+			$this->security->xss_clean('<image src="<>" onerror=\'alert(1)\'>')
+		);
+
+		$this->assertEquals(
+			'<b [removed] [removed]>',
+			$this->security->xss_clean('<b "=<= onmouseover=alert(1)>')
+		);
+
+		$this->assertEquals(
+			'<b [removed] [removed]alert&#40;1&#41;,1>1">',
+			$this->security->xss_clean('<b a=<=" onmouseover="alert(1),1>1">')
+		);
+	}
+
+	// --------------------------------------------------------------------
+
+	/**
+	 * @depends test_xss_clean_sanitize_naughty_html_tags
+	 * @depends test_xss_clean_sanitize_naughty_html_attributes
+	 */
+	public function test_naughty_html_plus_evil_attributes()
+	{
+		$this->assertEquals(
+			'&lt;svg<img &gt; src="x" [removed]>',
+			$this->security->xss_clean('<svg<img > src="x" onerror="location=/javascript/.source+/:alert/.source+/(1)/.source">')
+		);
 	}
 
 	// --------------------------------------------------------------------
diff --git a/tests/codeigniter/database/query_builder/where_test.php b/tests/codeigniter/database/query_builder/where_test.php
index 20b7a567c..46a7fa2eb 100644
--- a/tests/codeigniter/database/query_builder/where_test.php
+++ b/tests/codeigniter/database/query_builder/where_test.php
@@ -123,4 +123,12 @@ class Where_test extends CI_TestCase {
 		$this->assertEquals('Musician', $jobs[1]['name']);
 	}
 
+	// ------------------------------------------------------------------------
+
+	public function test_issue4093()
+	{
+		$input = 'bar and baz or qux';
+		$sql = $this->db->where('foo', $input)->get_compiled_select('dummy');
+		$this->assertEquals("'".$input."'", substr($sql, -20));
+	}
 }
\ No newline at end of file