Harden t() with DOMPurify

This mitigates issues where developers pass untrusted user-input through t() which may lead to XSS issues.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

diff --git a/core/js/core.json b/core/js/core.json
index d589208c828465a90b09d67cf8020d0d03436568..4d1d0685007f5cebb7b19b0442a54045868b38f2 100644 (file)
--- a/core/js/core.json
+++ b/core/js/core.json
@@ -12,7 +12,8 @@
                "es6-promise/dist/es6-promise.js",
                "davclient.js/lib/client.js",
                "clipboard/dist/clipboard.js",
-               "autosize/dist/autosize.js"
+               "autosize/dist/autosize.js",
+               "DOMPurify/dist/purify.min.js"
        ],
        "libraries": [
                "jquery-showpassword.js",

diff --git a/core/js/l10n.js b/core/js/l10n.js
index 43cfc7e820fa3b2482eb6d00a0334d8edfcce67c..77f771a20b3955be8248153c13e216015aa00aa1 100644 (file)
--- a/core/js/l10n.js
+++ b/core/js/l10n.js
@@ -155,12 +155,12 @@ OC.L10N = {
                                        var r = vars[b];
                                        if(typeof r === 'string' || typeof r === 'number') {
                                                if(allOptions.escape) {
-                                                       return escapeHTML(r);
+                                                       return DOMPurify.sanitize(escapeHTML(r));
                                                } else {
-                                                       return r;
+                                                       return DOMPurify.sanitize(r);
                                                }
                                        } else {
-                                               return a;
+                                               return DOMPurify.sanitize(a);
                                        }
                                }
                        );
@@ -173,9 +173,9 @@ OC.L10N = {
                }
 
                if(typeof vars === 'object' || count !== undefined ) {
-                       return _build(translation, vars, count);
+                       return DOMPurify.sanitize(_build(translation, vars, count));
                } else {
-                       return translation;
+                       return DOMPurify.sanitize(translation);
                }
        },
 

diff --git a/core/js/tests/specs/l10nSpec.js b/core/js/tests/specs/l10nSpec.js
index 064b27aa34a5bfd0e09769c5093e643bb924fc81..3dd1fa268ef693887ab0e37bf855a0407a045752 100644 (file)
--- a/core/js/tests/specs/l10nSpec.js
+++ b/core/js/tests/specs/l10nSpec.js
@@ -53,6 +53,11 @@ describe('OC.L10N tests', function() {
                                t(TEST_APP, 'Hello {name}', {name: '<strong>Steve</strong>'}, null, {escape: false})
                        ).toEqual('Hello <strong>Steve</strong>');
                });
+               it('uses DOMPurify to escape the text', function() {
+                       expect(
+                               t(TEST_APP, '<strong>These are your search results<script>alert(1)</script></strong>', null, {escape: false})
+                       ).toEqual('<strong>These are your search results</strong>');
+               });
                it('keeps old texts when registering existing bundle', function() {
                        OC.L10N.register(TEST_APP, {
                                'sunny': 'sonnig',

diff --git a/core/js/tests/specs/setupchecksSpec.js b/core/js/tests/specs/setupchecksSpec.js
index e18db4b7e57ee7b6eb61f8dcddd82c0c3665e9c8..937084aaa24ef755afba6ee3047e08f70fc0d5ab 100644 (file)
--- a/core/js/tests/specs/setupchecksSpec.js
+++ b/core/js/tests/specs/setupchecksSpec.js
@@ -68,7 +68,7 @@ describe('OC.SetupChecks tests', function() {
 
                        async.done(function( data, s, x ){
                                expect(data).toEqual([{
-                                       msg: 'Your web server is not set up properly to resolve "/.well-known/caldav/". Further information can be found in our <a target="_blank" rel="noreferrer" href="http://example.org/admin-setup-well-known-URL">documentation</a>.',
+                                       msg: 'Your web server is not set up properly to resolve "/.well-known/caldav/". Further information can be found in our <a href="http://example.org/admin-setup-well-known-URL" rel="noreferrer">documentation</a>.',
                                        type: OC.SetupChecks.MESSAGE_TYPE_INFO
                                }]);
                                done();
@@ -166,7 +166,7 @@ describe('OC.SetupChecks tests', function() {
                                                msg: 'This server has no working Internet connection: Multiple endpoints could not be reached. This means that some of the features like mounting external storage, notifications about updates or installation of third-party apps will not work. Accessing files remotely and sending of notification emails might not work, either. We suggest to enable Internet connection for this server if you want to have all features.',
                                                type: OC.SetupChecks.MESSAGE_TYPE_WARNING
                                        }, {
-                                               msg: 'No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our <a target="_blank" rel="noreferrer" href="https://doc.owncloud.org/server/go.php?to=admin-performance">documentation</a>.',
+                                               msg: 'No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our <a href="https://doc.owncloud.org/server/go.php?to=admin-performance" rel="noreferrer">documentation</a>.',
                                                type: OC.SetupChecks.MESSAGE_TYPE_INFO
                                        }]);
                                done();
@@ -200,7 +200,7 @@ describe('OC.SetupChecks tests', function() {
                                                type: OC.SetupChecks.MESSAGE_TYPE_WARNING
                                        },
                                        {
-                                               msg: 'No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our <a target="_blank" rel="noreferrer" href="https://doc.owncloud.org/server/go.php?to=admin-performance">documentation</a>.',
+                                               msg: 'No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our <a href="https://doc.owncloud.org/server/go.php?to=admin-performance" rel="noreferrer">documentation</a>.',
                                                type: OC.SetupChecks.MESSAGE_TYPE_INFO
                                        }]);
                                done();
@@ -261,7 +261,7 @@ describe('OC.SetupChecks tests', function() {
 
                        async.done(function( data, s, x ){
                                expect(data).toEqual([{
-                                       msg: '/dev/urandom is not readable by PHP which is highly discouraged for security reasons. Further information can be found in our <a target="_blank" rel="noreferrer" href="https://docs.owncloud.org/myDocs.html">documentation</a>.',
+                                       msg: '/dev/urandom is not readable by PHP which is highly discouraged for security reasons. Further information can be found in our <a href="https://docs.owncloud.org/myDocs.html" rel="noreferrer">documentation</a>.',
                                        type: OC.SetupChecks.MESSAGE_TYPE_WARNING
                                }]);
                                done();
@@ -291,7 +291,7 @@ describe('OC.SetupChecks tests', function() {
 
                        async.done(function( data, s, x ){
                                expect(data).toEqual([{
-                                       msg: 'Memcached is configured as distributed cache, but the wrong PHP module "memcache" is installed. \\OC\\Memcache\\Memcached only supports "memcached" and not "memcache". See the <a target="_blank" rel="noreferrer" href="https://code.google.com/p/memcached/wiki/PHPClientComparison">memcached wiki about both modules</a>.',
+                                       msg: 'Memcached is configured as distributed cache, but the wrong PHP module "memcache" is installed. \\OC\\Memcache\\Memcached only supports "memcached" and not "memcache". See the <a href="https://code.google.com/p/memcached/wiki/PHPClientComparison" rel="noreferrer">memcached wiki about both modules</a>.',
                                        type: OC.SetupChecks.MESSAGE_TYPE_WARNING
                                }]);
                                done();
@@ -321,7 +321,7 @@ describe('OC.SetupChecks tests', function() {
 
                        async.done(function( data, s, x ){
                                expect(data).toEqual([{
-                                       msg: 'The reverse proxy headers configuration is incorrect, or you are accessing Nextcloud from a trusted proxy. If you are not accessing Nextcloud from a trusted proxy, this is a security issue and can allow an attacker to spoof their IP address as visible to Nextcloud. Further information can be found in our <a target="_blank" rel="noreferrer" href="https://docs.owncloud.org/foo/bar.html">documentation</a>.',
+                                       msg: 'The reverse proxy headers configuration is incorrect, or you are accessing Nextcloud from a trusted proxy. If you are not accessing Nextcloud from a trusted proxy, this is a security issue and can allow an attacker to spoof their IP address as visible to Nextcloud. Further information can be found in our <a href="https://docs.owncloud.org/foo/bar.html" rel="noreferrer">documentation</a>.',
                                        type: OC.SetupChecks.MESSAGE_TYPE_WARNING
                                }]);
                                done();
@@ -402,7 +402,7 @@ describe('OC.SetupChecks tests', function() {
 
                        async.done(function( data, s, x ){
                                expect(data).toEqual([{
-                                       msg: 'You are currently running PHP 5.4.0. We encourage you to upgrade your PHP version to take advantage of <a target="_blank" rel="noreferrer" href="https://secure.php.net/supported-versions.php">performance and security updates provided by the PHP Group</a> as soon as your distribution supports it.',
+                                       msg: 'You are currently running PHP 5.4.0. We encourage you to upgrade your PHP version to take advantage of <a href="https://secure.php.net/supported-versions.php" rel="noreferrer">performance and security updates provided by the PHP Group</a> as soon as your distribution supports it.',
                                        type: OC.SetupChecks.MESSAGE_TYPE_INFO
                                }]);
                                done();
@@ -433,7 +433,7 @@ describe('OC.SetupChecks tests', function() {
 
                        async.done(function( data, s, x ){
                                expect(data).toEqual([{
-                                               msg: 'The PHP Opcache is not properly configured. <a target="_blank" rel="noreferrer" href="https://example.org/link/to/doc">For better performance we recommend ↗</a> to use following settings in the <code>php.ini</code>:' + "<pre><code>opcache.enable=On\nopcache.enable_cli=1\nopcache.interned_strings_buffer=8\nopcache.max_accelerated_files=10000\nopcache.memory_consumption=128\nopcache.save_comments=1\nopcache.revalidate_freq=1</code></pre>",
+                                               msg: 'The PHP Opcache is not properly configured. <a href="https://example.org/link/to/doc" rel="noreferrer">For better performance we recommend ↗</a> to use following settings in the <code>php.ini</code>:' + "<pre><code>opcache.enable=On\nopcache.enable_cli=1\nopcache.interned_strings_buffer=8\nopcache.max_accelerated_files=10000\nopcache.memory_consumption=128\nopcache.save_comments=1\nopcache.revalidate_freq=1</code></pre>",
                                                type: OC.SetupChecks.MESSAGE_TYPE_INFO
                                        }]);
                                done();
@@ -617,7 +617,7 @@ describe('OC.SetupChecks tests', function() {
 
                async.done(function( data, s, x ){
                        expect(data).toEqual([{
-                               msg: 'The "Strict-Transport-Security" HTTP header is not configured to at least "15552000" seconds. For enhanced security we recommend enabling HSTS as described in our <a href="http://localhost/index.php/settings/admin/tips-tricks" rel="noreferrer">security tips</a>.',
+                               msg: 'The "Strict-Transport-Security" HTTP header is not configured to at least "15552000" seconds. For enhanced security we recommend enabling HSTS as described in our <a rel="noreferrer" href="http://localhost/index.php/settings/admin/tips-tricks">security tips</a>.',
                                type: OC.SetupChecks.MESSAGE_TYPE_WARNING
                        }]);
                        done();
@@ -642,7 +642,7 @@ describe('OC.SetupChecks tests', function() {
 
                async.done(function( data, s, x ){
                        expect(data).toEqual([{
-                               msg: 'The "Strict-Transport-Security" HTTP header is not configured to at least "15552000" seconds. For enhanced security we recommend enabling HSTS as described in our <a href="http://localhost/index.php/settings/admin/tips-tricks" rel="noreferrer">security tips</a>.',
+                               msg: 'The "Strict-Transport-Security" HTTP header is not configured to at least "15552000" seconds. For enhanced security we recommend enabling HSTS as described in our <a rel="noreferrer" href="http://localhost/index.php/settings/admin/tips-tricks">security tips</a>.',
                                type: OC.SetupChecks.MESSAGE_TYPE_WARNING
                        }]);
                        done();
@@ -667,7 +667,7 @@ describe('OC.SetupChecks tests', function() {
 
                async.done(function( data, s, x ){
                        expect(data).toEqual([{
-                               msg: 'The "Strict-Transport-Security" HTTP header is not configured to at least "15552000" seconds. For enhanced security we recommend enabling HSTS as described in our <a href="http://localhost/index.php/settings/admin/tips-tricks" rel="noreferrer">security tips</a>.',
+                               msg: 'The "Strict-Transport-Security" HTTP header is not configured to at least "15552000" seconds. For enhanced security we recommend enabling HSTS as described in our <a rel="noreferrer" href="http://localhost/index.php/settings/admin/tips-tricks">security tips</a>.',
                                type: OC.SetupChecks.MESSAGE_TYPE_WARNING
                        }]);
                        done();

diff --git a/settings/templates/apps.php b/settings/templates/apps.php
index 80689237e60c981a5a35c168b16a96dd65c67281..99d648c628494e989080ad3504d8636db831b008 100644 (file)
--- a/settings/templates/apps.php
+++ b/settings/templates/apps.php
@@ -5,7 +5,6 @@ vendor_script(
        [
                'handlebars/handlebars',
                'marked/marked.min',
-               'DOMPurify/dist/purify.min',
        ]
 );
 script(