From 8579648b77a4f751f5e31f512e56a82feab5de30 Mon Sep 17 00:00:00 2001 From: Jakub Mikita Date: Fri, 29 Oct 2021 09:19:31 +0200 Subject: [PATCH 01/21] add escaping and nonce verification --- composer.json | 3 +- composer.lock | 52 ++++++++++++- phpstan-baseline.neon | 15 ---- readme.txt | 4 + resources/js/src/component/mergetag.js | 1 + resources/js/src/component/switch.js | 1 + resources/js/src/component/sync.js | 1 + resources/templates/carriers/widget-add.php | 11 ++- resources/templates/debug/error-log.php | 2 +- .../templates/debug/notification-log.php | 16 +++- resources/templates/debug/pagination.php | 14 ++-- .../extension/extension-box-premium.php | 2 +- .../templates/extension/extension-box.php | 2 +- resources/templates/form/field-hidden.php | 4 +- resources/templates/form/field.php | 8 +- .../templates/help/global-merge-tags.php | 2 +- resources/templates/settings/page.php | 4 +- resources/templates/upsell/carriers-list.php | 11 ++- .../templates/upsell/conditionals-metabox.php | 3 +- .../templates/upsell/custom-development.php | 6 +- .../upsell/scheduled-triggers-setting.php | 3 +- src/Abstracts/MergeTag.php | 2 +- src/Admin/Debugging.php | 21 +++-- src/Admin/Extensions.php | 76 +++++++++++-------- src/Admin/ImportExport.php | 34 ++++----- src/Admin/NotificationDuplicator.php | 18 +++-- src/Admin/PostTable.php | 29 +++---- src/Admin/PostType.php | 34 ++------- src/Admin/Screen.php | 31 +------- src/Admin/Scripts.php | 1 + src/Admin/Settings.php | 13 +--- src/Admin/Sync.php | 4 +- src/Admin/Wizard.php | 22 +----- src/Core/Cron.php | 7 +- src/Core/Debugging.php | 23 ++---- src/Core/Queue.php | 6 +- src/Core/Sync.php | 36 ++++++--- src/Core/Upgrade.php | 20 ++--- src/Defaults/Carrier/Email.php | 6 +- src/Defaults/Trigger/Post/PostTrigger.php | 10 +-- .../Trigger/User/UserPasswordResetRequest.php | 5 +- .../Trigger/WordPress/UpdatesAvailable.php | 27 +++---- src/Repository/GlobalMergeTagRepository.php | 6 +- src/Traits/Webhook.php | 2 +- src/Utils/Settings.php | 39 +++------- src/Utils/Settings/CoreFields/Button.php | 2 +- src/Utils/Settings/CoreFields/Message.php | 5 +- src/Utils/Settings/CoreFields/Select.php | 6 +- src/Utils/WpObjectHelper.php | 47 +++++++----- 49 files changed, 348 insertions(+), 349 deletions(-) diff --git a/composer.json b/composer.json index 3f40757f9..6a47a370a 100644 --- a/composer.json +++ b/composer.json @@ -4,8 +4,9 @@ "license": "GPL-3.0-or-later", "description": "Notification plugin for WordPress", "require": { - "composer-runtime-api": "^2.0", "php": "^7.0", + "composer-runtime-api": "^2.0", + "enshrined/svg-sanitize": "^0.14.1", "micropackage/ajax": "^1.0", "micropackage/dochooks": "1.0.2", "micropackage/filesystem": "^1.1", diff --git a/composer.lock b/composer.lock index b65f8c075..2c00c5bfb 100644 --- a/composer.lock +++ b/composer.lock @@ -4,8 +4,54 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "73caec09742a40d66eb761a8ac5d029a", + "content-hash": "73d95408e7ddb8485b92b953cf7868d2", "packages": [ + { + "name": "enshrined/svg-sanitize", + "version": "0.14.1", + "source": { + "type": "git", + "url": "https://github.com/darylldoyle/svg-sanitizer.git", + "reference": "307b42066fb0b76b5119f5e1f0826e18fefabe95" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/darylldoyle/svg-sanitizer/zipball/307b42066fb0b76b5119f5e1f0826e18fefabe95", + "reference": "307b42066fb0b76b5119f5e1f0826e18fefabe95", + "shasum": "" + }, + "require": { + "ext-dom": "*", + "ext-libxml": "*", + "php": "^7.0 || ^8.0" + }, + "require-dev": { + "codeclimate/php-test-reporter": "^0.1.2", + "phpunit/phpunit": "^6.5 || ^8.5" + }, + "type": "library", + "autoload": { + "psr-4": { + "enshrined\\svgSanitize\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "GPL-2.0-or-later" + ], + "authors": [ + { + "name": "Daryll Doyle", + "email": "daryll@enshrined.co.uk" + } + ], + "description": "An SVG sanitizer for PHP", + "support": { + "issues": "https://github.com/darylldoyle/svg-sanitizer/issues", + "source": "https://github.com/darylldoyle/svg-sanitizer/tree/0.14.1" + }, + "time": "2021-08-09T23:46:54+00:00" + }, { "name": "micropackage/ajax", "version": "1.0.1", @@ -2815,8 +2861,8 @@ "prefer-stable": false, "prefer-lowest": false, "platform": { - "composer-runtime-api": "^2.0", - "php": "^7.0" + "php": "^7.0", + "composer-runtime-api": "^2.0" }, "platform-dev": [], "plugin-api-version": "2.0.0" diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon index c2a43bf51..0f1e04bcf 100644 --- a/phpstan-baseline.neon +++ b/phpstan-baseline.neon @@ -590,11 +590,6 @@ parameters: count: 1 path: src/Admin/Extensions.php - - - message: "#^Parameter \\#2 \\$now of function strtotime expects int, int\\|string given\\.$#" - count: 1 - path: src/Admin/Extensions.php - - message: "#^Property BracketSpace\\\\Notification\\\\Admin\\\\Extensions\\:\\:\\$extensions type has no value type specified in iterable type array\\.$#" count: 1 @@ -615,11 +610,6 @@ parameters: count: 1 path: src/Admin/ImportExport.php - - - message: "#^Method BracketSpace\\\\Notification\\\\Admin\\\\ImportExport\\:\\:prepare_notifications_export_data\\(\\) return type has no value type specified in iterable type array\\.$#" - count: 1 - path: src/Admin/ImportExport.php - - message: "#^Method BracketSpace\\\\Notification\\\\Admin\\\\ImportExport\\:\\:process_notifications_import_request\\(\\) has parameter \\$data with no value type specified in iterable type array\\.$#" count: 1 @@ -990,11 +980,6 @@ parameters: count: 2 path: src/Core/Binder.php - - - message: "#^Binary operation \"\\+\" between int\\|string and 86400 results in an error\\.$#" - count: 1 - path: src/Core/Cron.php - - message: "#^Method BracketSpace\\\\Notification\\\\Core\\\\Cron\\:\\:register_intervals\\(\\) has parameter \\$intervals with no value type specified in iterable type array\\.$#" count: 1 diff --git a/readme.txt b/readme.txt index 50981d524..511d82abf 100644 --- a/readme.txt +++ b/readme.txt @@ -295,6 +295,10 @@ Yes, just activate the debug log in the DEBUGGING section of the plugin settings == Changelog == += [Next] = + +* [Added] HTML escaping and nonce verifications. + = 8.0.1 = * [Changed] Field and Merge Tag description field is now escaped and cannot contain any HTML tags. diff --git a/resources/js/src/component/mergetag.js b/resources/js/src/component/mergetag.js index 4b97b1599..dec9de9d4 100644 --- a/resources/js/src/component/mergetag.js +++ b/resources/js/src/component/mergetag.js @@ -41,6 +41,7 @@ import "jquery-collapse/src/jquery.collapse.js"; const data = { action: "get_merge_tags_for_trigger", + _ajax_nonce: notification.csrfToken, trigger_slug: triggerSlug }; diff --git a/resources/js/src/component/switch.js b/resources/js/src/component/switch.js index 0665ef4a9..5f25dfa97 100644 --- a/resources/js/src/component/switch.js +++ b/resources/js/src/component/switch.js @@ -25,6 +25,7 @@ const data = { action: "change_notification_status", + _ajax_nonce: notification.csrfToken, post_id: postId, status, nonce: $switch.data("nonce") diff --git a/resources/js/src/component/sync.js b/resources/js/src/component/sync.js index 0d630b1c7..59de0869f 100644 --- a/resources/js/src/component/sync.js +++ b/resources/js/src/component/sync.js @@ -61,6 +61,7 @@ const data = { action: "notification_sync", + _ajax_nonce: notification.csrfToken, hash, type: syncType, nonce diff --git a/resources/templates/carriers/widget-add.php b/resources/templates/carriers/widget-add.php index 1bcdc9809..2d615353d 100644 --- a/resources/templates/carriers/widget-add.php +++ b/resources/templates/carriers/widget-add.php @@ -9,6 +9,10 @@ * @var BracketSpace\Notification\Dependencies\Micropackage\Templates\Template $this Template instance. */ +use BracketSpace\Notification\Dependencies\enshrined\svgSanitize\Sanitizer; + +$svg_sanitizer = new Sanitizer(); + ?>
>
diff --git a/resources/templates/debug/notification-log.php b/resources/templates/debug/notification-log.php index c9455a6b5..3a62607a6 100644 --- a/resources/templates/debug/notification-log.php +++ b/resources/templates/debug/notification-log.php @@ -64,7 +64,13 @@ -
+

+												
+											
@@ -84,7 +90,13 @@ -
+

+													
+												
diff --git a/resources/templates/debug/pagination.php b/resources/templates/debug/pagination.php index 3c6f704c3..41ddbf540 100644 --- a/resources/templates/debug/pagination.php +++ b/resources/templates/debug/pagination.php @@ -9,14 +9,14 @@ * @var BracketSpace\Notification\Dependencies\Micropackage\Templates\Template $this Template instance. */ +$links = paginate_links( [ + 'base' => admin_url( 'edit.php?post_type=notification&page=settings§ion=debugging&' . $get( 'query_arg' ) . '=%#%' ), + 'current' => $get( 'current' ), + 'total' => $get( 'total' ), +] ); + ?>
- admin_url( 'edit.php?post_type=notification&page=settings§ion=debugging&' . $get( 'query_arg' ) . '=%#%' ), - 'current' => $get( 'current' ), - 'total' => $get( 'total' ), - ] ); - ?> +
diff --git a/resources/templates/extension/extension-box-premium.php b/resources/templates/extension/extension-box-premium.php index fd0b4f1fd..df18110ac 100644 --- a/resources/templates/extension/extension-box-premium.php +++ b/resources/templates/extension/extension-box-premium.php @@ -31,7 +31,7 @@ expires ) : ?> -

expires, current_time( 'timestamp' ) ) ) ) ); // phpcs:ignore ?>

+

expires, time() ) ) ) ); ?>

diff --git a/resources/templates/extension/extension-box.php b/resources/templates/extension/extension-box.php index 3d833bf4d..4beba9aee 100644 --- a/resources/templates/extension/extension-box.php +++ b/resources/templates/extension/extension-box.php @@ -86,7 +86,7 @@