Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XSS 対応 #1101

Merged
merged 20 commits into from
Jul 29, 2024
Merged

XSS 対応 #1101

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
9ce916a
fix: XSS
drill-lancer Jul 24, 2024
011226c
fix: escape
drill-lancer Jul 24, 2024
384470e
fix: post_type_manager
drill-lancer Jul 25, 2024
564c846
fix: readme
drill-lancer Jul 25, 2024
1af6ee6
fix: stripslashes
drill-lancer Jul 29, 2024
cab8505
add escape
kurudrive Jul 29, 2024
8e27091
fix: escape cta
drill-lancer Jul 29, 2024
5f279eb
コメントのみ
kurudrive Jul 29, 2024
8fdfa02
add escape
kurudrive Jul 29, 2024
3cfb45d
add escape
kurudrive Jul 29, 2024
dffea58
add escape
kurudrive Jul 29, 2024
c2f31cd
add escape
kurudrive Jul 29, 2024
73bb9b1
add escape
kurudrive Jul 29, 2024
8589855
add escape
kurudrive Jul 29, 2024
cfeaa1a
fix: tel_iconはfont awesomeのタグのみ許可
mthaichi Jul 29, 2024
7415bb7
fix: space
mthaichi Jul 29, 2024
911d533
add esc
kurudrive Jul 29, 2024
02a8bb1
allow area hidden
kurudrive Jul 29, 2024
552a6b2
Merge branch 'fix-area-hidden' into fix/xss
kurudrive Jul 29, 2024
807a5a4
add esc
kurudrive Jul 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions inc/call-to-action/package/class-vk-call-to-action.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,40 +166,40 @@ public static function save_custom_field( $post_id ) {
'escape_type' => '',
),
'vkExUnit_cta_img' => array(
'escape_type' => '',
'escape_type' => 'esc_url',
),
'vkExUnit_cta_img_position' => array(
'escape_type' => '',
),
'vkExUnit_cta_button_text' => array(
'escape_type' => 'stripslashes',
'escape_type' => 'wp_kses_post',
),
'vkExUnit_cta_button_icon' => array(
'escape_type' => 'stripslashes',
'escape_type' => 'wp_kses_post',
),
'vkExUnit_cta_button_icon_before' => array(
'escape_type' => 'stripslashes',
'escape_type' => 'wp_kses_post',
),
'vkExUnit_cta_button_icon_after' => array(
'escape_type' => 'stripslashes',
'escape_type' => 'wp_kses_post',
),
'vkExUnit_cta_url' => array(
'escape_type' => '',
'escape_type' => 'esc_url',
),
'vkExUnit_cta_url_blank' => array(
'escape_type' => '',
),
'vkExUnit_cta_text' => array(
'escape_type' => 'stripslashes',
'escape_type' => 'wp_kses_post',
),
);

// カスタムフィールドの保存.
foreach ( $custom_fields as $custom_field_name => $custom_field_options ) {

if ( isset( $_POST[ $custom_field_name ] ) ) {
if ( isset( $custom_field_name['escape_type'] ) && $custom_field_name['escape_type'] == 'stripslashes' ) {
$data = stripslashes( $_POST[ $custom_field_name ] );
if ( ! empty( $custom_field_name['escape_type'] ) ) {
$data = call_user_func( $custom_field_name['escape_type'], $_POST[ $custom_field_name ] );
} else {
$data = $_POST[ $custom_field_name ];
}
Expand Down Expand Up @@ -545,7 +545,7 @@ public static function render_cta_content( $id ) {
wp_reset_postdata();

// wp_kses_post でエスケープすると outerブロックが出力するstyle属性を無効化される.
return do_blocks( do_shortcode( $content ) );
return do_blocks( do_shortcode( wp_kses_post( $content ) ) );
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@drill-lancer コメントに書いてある通り wp_kses_post でエスケープすると outerブロックが出力するstyle属性を無効化される ので、style 属性が消されないように wp_kses を作るなどして対応してください。

}

/**
Expand Down
18 changes: 9 additions & 9 deletions inc/contact-section/contact-section.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,16 +241,16 @@ public function options_page() {
}

public function option_sanitaize( $option ) {
$option['contact_txt'] = stripslashes( $option['contact_txt'] );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@drill-lancer この部分でstripslashesを削除しているので、例えば Vektor's といった文字列を保存しようとすると、バックスラッシュがテキストエリアに残り、それに気づかず保存すると、倍々にバックスラッシュが増えてしまいます。

ご存知のことかもしれませんが、
WordPressは $_POSTに対して、add_magic_quotes()をかけます。$_POSTには Vektor\'s という値で入ってきます。ですから、これに対して、wp_unslashやstripslashesで戻す処理は必要かと。

Copy link
Contributor

@mthaichi mthaichi Jul 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CTA関連でも同様の修正がありますが、こちらはupdate_metadata() 内で、wp_unslashが自動的にかかるのでバックスラッシュを外す処理は不要です。これに関してはstripslashesを通すのは無意味となるので、外して正解だと思います。

$option['tel_number'] = stripslashes( $option['tel_number'] );
$option['tel_icon'] = stripslashes( $option['tel_icon'] );
$option['contact_time'] = stripslashes( $option['contact_time'] );
$option['contact_link'] = stripslashes( $option['contact_link'] );
$option['button_text'] = stripslashes( $option['button_text'] );
$option['button_text_small'] = stripslashes( $option['button_text_small'] );
$option['short_text'] = stripslashes( $option['short_text'] );
$option['contact_txt'] = wp_kses_post( $option['contact_txt'] );
$option['tel_number'] = wp_kses_post( $option['tel_number'] );
$option['tel_icon'] = wp_kses_post( $option['tel_icon'] );
$option['contact_time'] = wp_kses_post( $option['contact_time'] );
$option['contact_link'] = wp_kses_post( $option['contact_link'] );
$option['button_text'] = wp_kses_post( $option['button_text'] );
$option['button_text_small'] = wp_kses_post( $option['button_text_small'] );
$option['short_text'] = wp_kses_post( $option['short_text'] );
$option['contact_image'] = esc_url( $option['contact_image'] );
$option['contact_html'] = stripslashes( $option['contact_html'] );
$option['contact_html'] = wp_kses_post( $option['contact_html'] );
return $option;
}

Expand Down
14 changes: 7 additions & 7 deletions inc/other-widget/widget-3pr-area.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,13 +137,13 @@ function update( $new_instance, $old_instance ) {
$instance = $old_instance;

for ( $i = 1; $i <= 3; ) {
$instance[ 'label_' . $i ] = $new_instance[ 'label_' . $i ];
$instance[ 'media_3pr_image_' . $i ] = $new_instance[ 'media_3pr_image_' . $i ];
$instance[ 'media_3pr_alt_' . $i ] = $new_instance[ 'media_3pr_alt_' . $i ];
$instance[ 'media_3pr_image_sp_' . $i ] = $new_instance[ 'media_3pr_image_sp_' . $i ];
$instance[ 'media_3pr_alt_sp_' . $i ] = $new_instance[ 'media_3pr_alt_sp_' . $i ];
$instance[ 'summary_' . $i ] = $new_instance[ 'summary_' . $i ];
$instance[ 'linkurl_' . $i ] = $new_instance[ 'linkurl_' . $i ];
$instance[ 'label_' . $i ] = wp_kses_post( $new_instance[ 'label_' . $i ] );
$instance[ 'media_3pr_image_' . $i ] = esc_url( $new_instance[ 'media_3pr_image_' . $i ] );
$instance[ 'media_3pr_alt_' . $i ] = esc_html( $new_instance[ 'media_3pr_alt_' . $i ] );
$instance[ 'media_3pr_image_sp_' . $i ] = esc_url( $new_instance[ 'media_3pr_image_sp_' . $i ] );
$instance[ 'media_3pr_alt_sp_' . $i ] = esc_html( $new_instance[ 'media_3pr_alt_sp_' . $i ] );
$instance[ 'summary_' . $i ] = wp_kses_post( $new_instance[ 'summary_' . $i ] );
$instance[ 'linkurl_' . $i ] = esc_url( $new_instance[ 'linkurl_' . $i ] );
$instance[ 'blank_' . $i ] = ( isset( $new_instance[ 'blank_' . $i ] ) && $new_instance[ 'blank_' . $i ] == 'true' );
$i++;
}
Expand Down
8 changes: 4 additions & 4 deletions inc/other-widget/widget-button.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,10 +206,10 @@ function form( $instance ) {
function update( $new_instance, $old_instance ) {
$opt = array();
$opt['title'] = wp_kses_post( $new_instance['title'] );
$opt['icon_before'] = $new_instance['icon_before'];
$opt['icon_after'] = $new_instance['icon_after'];
$opt['subtext'] = $new_instance['subtext'];
$opt['linkurl'] = $new_instance['linkurl'];
$opt['icon_before'] = wp_kses_post( $new_instance['icon_before'] );
$opt['icon_after'] = wp_kses_post( $new_instance['icon_after'] );
$opt['subtext'] = wp_kses_post( $new_instance['subtext'] );
$opt['linkurl'] = esc_url( $new_instance['linkurl'] );
$opt['blank'] = ( isset( $new_instance['blank'] ) && $new_instance['blank'] == 'true' );
$opt['size'] = in_array( $new_instance['size'], array( 'sm', 'lg' ) ) ? $new_instance['size'] : 'md';
$opt['color'] = in_array( $new_instance['color'], array_keys( self::button_otherlabels() ) ) ? $new_instance['color'] : static::$button_default;
Expand Down
2 changes: 1 addition & 1 deletion inc/other-widget/widget-page.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ function form( $instance ) {
// 保存・更新する値
function update( $new_instance, $old_instance ) {
$instance = $old_instance;
$instance['title'] = $new_instance['title'];
$instance['title'] = wp_kses_post( $new_instance['title'] );
$instance['page_id'] = $new_instance['page_id'];
$instance['set_title'] = $new_instance['set_title'];
$instance['child_page_index'] = $new_instance['child_page_index'];
Expand Down
14 changes: 7 additions & 7 deletions inc/other-widget/widget-pr-blocks.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,14 +206,14 @@ public function update( $new_instance, $old_instance ) {
}

for ( $i = 1; $i <= 4; ) {
$instance[ 'label_' . $i ] = $new_instance[ 'label_' . $i ];
$instance[ 'media_image_' . $i ] = $new_instance[ 'media_image_' . $i ];
$instance[ 'media_alt_' . $i ] = $new_instance[ 'media_alt_' . $i ];
$instance[ 'iconFont_class_' . $i ] = $new_instance[ 'iconFont_class_' . $i ];
$instance[ 'iconFont_bgColor_' . $i ] = $new_instance[ 'iconFont_bgColor_' . $i ];
$instance[ 'label_' . $i ] = wp_kses_post( $new_instance[ 'label_' . $i ] );
$instance[ 'media_image_' . $i ] = esc_url( $new_instance[ 'media_image_' . $i ] );
$instance[ 'media_alt_' . $i ] = esc_html( $new_instance[ 'media_alt_' . $i ] );
$instance[ 'iconFont_class_' . $i ] = esc_html( $new_instance[ 'iconFont_class_' . $i ] );
$instance[ 'iconFont_bgColor_' . $i ] = esc_html( $new_instance[ 'iconFont_bgColor_' . $i ] );
$instance[ 'iconFont_bgType_' . $i ] = $new_instance[ 'iconFont_bgType_' . $i ];
$instance[ 'summary_' . $i ] = $new_instance[ 'summary_' . $i ];
$instance[ 'linkurl_' . $i ] = $new_instance[ 'linkurl_' . $i ];
$instance[ 'summary_' . $i ] = wp_kses_post( $new_instance[ 'summary_' . $i ] );
$instance[ 'linkurl_' . $i ] = esc_url( $new_instance[ 'linkurl_' . $i ] );
$instance[ 'blank_' . $i ] = ( isset( $new_instance[ 'blank_' . $i ] ) && $new_instance[ 'blank_' . $i ] == 'true' );
$i++;
}
Expand Down
14 changes: 7 additions & 7 deletions inc/other-widget/widget-profile.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,24 +181,24 @@ function form( $instance ) {
/*-------------------------------------------*/
function update( $new_instance, $old_instance ) {
$instance = $old_instance;
$instance['label'] = $new_instance['label'];
$instance['mediaFile'] = $new_instance['mediaFile'];
$instance['mediaAlt'] = $new_instance['mediaAlt'];
$instance['profile'] = $new_instance['profile'];
$instance['label'] = wp_kses_post( $new_instance['label'] );
$instance['mediaFile'] = esc_url( $new_instance['mediaFile'] );
$instance['mediaAlt'] = esc_html( $new_instance['mediaAlt'] );
$instance['profile'] = wp_kses_post( $new_instance['profile'] );
$instance['mediaAlign_left'] = $new_instance['mediaAlign_left'];
$instance['mediaAlign'] = $new_instance['mediaAlign'];
$instance['mediaRound'] = $new_instance['mediaRound'];
$instance['mediaSize'] = $new_instance['mediaSize'];
$instance['mediaSize'] = esc_html( $new_instance['mediaSize'] );
$instance['mediaFloat'] = $new_instance['mediaFloat'];
$instance['facebook'] = esc_url( $new_instance['facebook'] );
$instance['twitter'] = esc_url( $new_instance['twitter'] );
$instance['mail'] = esc_attr( $new_instance['mail'] );
$instance['mail'] = esc_url( $new_instance['mail'] );
$instance['youtube'] = esc_url( $new_instance['youtube'] );
$instance['rss'] = esc_url( $new_instance['rss'] );
$instance['instagram'] = esc_url( $new_instance['instagram'] );
$instance['linkedin'] = esc_url( $new_instance['linkedin'] );
$instance['iconFont_bgType'] = $new_instance['iconFont_bgType'];
$instance['icon_color'] = $new_instance['icon_color'];
$instance['icon_color'] = esc_html( $new_instance['icon_color'] );
return $instance;
}
/*-------------------------------------------*/
Expand Down
58 changes: 34 additions & 24 deletions inc/post-type-manager/package/class.post-type-manager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,8 +109,9 @@ public static function add_meta_box_action() {
/*******************************************
* Supports(Required)
*/
echo '<h4>' . esc_html__( 'Supports(Required)', 'vk-all-in-one-expansion-unit' ) . '</h4>';
echo '<h4>' . esc_html__( 'Supports ( Required )', 'vk-all-in-one-expansion-unit' ) . '</h4>';
$post_type_items_value = get_post_meta( $post->ID, 'veu_post_type_items', true );

echo '<ul>';
foreach ( $post_type_items_array as $key => $label ) {
$checked = ( isset( $post_type_items_value[ $key ] ) && $post_type_items_value[ $key ] ) ? ' checked' : '';
Expand Down Expand Up @@ -323,33 +324,42 @@ public static function save_cf_value( $post_id ) {
if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
return $post_id;
}

$post_type_id = ! empty( $_POST['veu_post_type_id'] ) ? esc_html( strip_tags( $_POST['veu_post_type_id'] ) ) : '';
$post_type_items = ! empty( $_POST['veu_post_type_items'] ) ? $_POST['veu_post_type_items'] : '';
$menu_posttion = ! empty( $_POST['veu_menu_position'] ) ? esc_html( strip_tags( $_POST['veu_menu_position'] ) ) : '';
$menu_icon = ! empty( $_POST['veu_menu_icon'] ) ? esc_html( strip_tags( $_POST['veu_menu_icon'] ) ) : '';
$post_type_export_to_api = ! empty( $_POST['veu_post_type_export_to_api'] ) ? esc_html( $_POST['veu_post_type_export_to_api'] ) : '';
$post_type_rewrite = ! empty( $_POST['veu_post_type_rewrite'] ) ? esc_html( $_POST['veu_post_type_rewrite'] ) : '';

if ( ! empty ( $_POST['veu_taxonomy'] ) ) {
$taxonomy = $_POST['veu_taxonomy'];

for ( $i = 1; $i <= apply_filters( 'veu_post_type_taxonomies', 5 ); $i++ ) {
$taxonomy[$i]['slug'] = ! empty( $taxonomy[$i]['slug'] ) ? esc_html( strip_tags( $taxonomy[$i]['slug'] ) ) : '';
$taxonomy[$i]['label'] = ! empty( $taxonomy[$i]['label'] ) ? esc_html( strip_tags( $taxonomy[$i]['label'] ) ) : '';
$taxonomy[$i]['tag'] = ! empty( $taxonomy[$i]['tag'] ) ? esc_html( $taxonomy[$i]['tag'] ) : '';
$taxonomy[$i]['rest_api'] = ! empty( $taxonomy[$i]['rest_api'] ) ? esc_html( $taxonomy[$i]['rest_api'] ) : '';
}
}

// 保存しているカスタムフィールド.
// 保存しているカスタムフィールド.
$fields = array(
'veu_post_type_id',
'veu_post_type_items',
'veu_menu_position',
'veu_menu_icon',
'veu_post_type_export_to_api',
'veu_post_type_rewrite',
'veu_taxonomy',
'veu_post_type_id' => $post_type_id,
'veu_post_type_items' => $post_type_items,
'veu_menu_position' => $menu_posttion,
'veu_menu_icon' => $menu_icon,
'veu_post_type_export_to_api' => $post_type_export_to_api,
'veu_post_type_rewrite' => $post_type_rewrite,
'veu_taxonomy' => $taxonomy,
);

foreach ( $fields as $key => $field ) {
$field_value = ( isset( $_POST[ $field ] ) ) ? $_POST[ $field ] : '';

// データが空だったら入れる.
if ( get_post_meta( $post_id, $field ) == '' ) {
add_post_meta( $post_id, $field, $field_value, true );

// 今入ってる値と違ってたらアップデートする.
} elseif ( get_post_meta( $post_id, $field, true ) !== $field_value ) {
update_post_meta( $post_id, $field, $field_value );

// 入力がなかったら消す.
} elseif ( '' === $field_value ) {
delete_post_meta( $post_id, $field, get_post_meta( $post_id, $field, true ) );
}
foreach ( $fields as $field_name => $field_value ) {
if ( ! empty( $field_value ) ) {
update_post_meta( $post_id, $field_name, $field_value );
} else {
delete_post_meta( $post_id, $field_name );
}
}

// リライトルールを更新するように.
Expand Down
6 changes: 3 additions & 3 deletions inc/sns/widget-fb-page-plugin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,9 +51,9 @@ function widget( $args, $instance ) {

function update( $new_instance, $old_instance ) {
$instance = $old_instance;
$instance['label'] = $new_instance['label'];
$instance['page_url'] = $new_instance['page_url'];
$instance['height'] = $new_instance['height'];
$instance['label'] = wp_kses_post( $new_instance['label'] );
$instance['page_url'] = esc_url( $new_instance['page_url'] );
$instance['height'] = esc_html( $new_instance['height'] );
$instance['showFaces'] = $new_instance['showFaces'];
$instance['hideCover'] = $new_instance['hideCover'];
$instance['showPosts'] = $new_instance['showPosts'];
Expand Down
2 changes: 2 additions & 0 deletions readme.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ e.g.

== Changelog ==

[ Bug fix ] Fix XSS of Widgets, CTA, Custom Post Type Manager.

= 9.99.0 =
[ Specification Change ] Foce Load JS from footer is abolished.
[ Fix ] Add a title attribute on Google Tag Manager (noscript)
Expand Down
Loading