Skip to content

Commit a032053

Browse files
author
Volodymyr klymenko
committed
Merge branch 'develop' of github.corp.ebay.com:magento2/magento2ce into develop
2 parents 5c0297f + be89bd9 commit a032053

File tree

7 files changed

+65
-9
lines changed

7 files changed

+65
-9
lines changed

‎app/code/Magento/OfflinePayments/etc/adminhtml/system.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@
166166
<label>Automatically Invoice All Items</label>
167167
<source_model>Magento\Payment\Model\Source\Invoice</source_model>
168168
<depends>
169-
<field id="order_status" separator=",">processing,processed_ogone</field>
169+
<field id="order_status" separator=",">processing</field>
170170
</depends>
171171
</field>
172172
<field id="sort_order" translate="label" type="text" sortOrder="100" showInDefault="1" showInWebsite="1" showInStore="0">

‎app/code/Magento/Payment/view/frontend/templates/transparent/iframe.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ $params = $block->getParams();
1313
<head>
1414
<script>
1515
<?php if (isset($params['redirect'])): ?>
16-
window.location="<?php echo $block->escapeUrl($params['redirect']) ?>";
16+
window.location="<?php echo $block->escapeXssInUrl($params['redirect']) ?>";
1717
<?php elseif (isset($params['redirect_parent'])): ?>
18-
window.top.location="<?php echo $block->escapeUrl($params['redirect_parent']) ?>";
18+
window.top.location="<?php echo $block->escapeXssInUrl($params['redirect_parent']) ?>";
1919
<?php elseif (isset($params['error_msg'])): ?>
2020
window.top.alert(<?php echo $this->helper('Magento\Framework\Json\Helper\Data')->jsonEncode($params['error_msg']) ?>);
2121
<?php elseif (isset($params['order_success'])): ?>

‎dev/tests/integration/testsuite/Magento/Payment/Block/Transparent/IframeTest.php

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,19 @@
55
*/
66
namespace Magento\Payment\Block\Transparent;
77

8+
/**
9+
* Class IframeTest
10+
* @package Magento\Payment\Block\Transparent
11+
*/
812
class IframeTest extends \PHPUnit_Framework_TestCase
913
{
1014
/**
1115
* @magentoAppIsolation enabled
1216
* @magentoAppArea frontend
17+
* @dataProvider xssDataProvider
1318
*/
14-
public function testToHtml()
19+
public function testToHtml($xssString)
1520
{
16-
$xssString = '</script><script>alert("XSS")</script>';
17-
1821
/** @var $block Iframe */
1922
$block = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->get(
2023
'Magento\Framework\View\LayoutInterface'
@@ -34,7 +37,20 @@ public function testToHtml()
3437

3538
$content = $block->toHtml();
3639

37-
$this->assertNotContains($xssString, $content, 'Params mast be escaped');
38-
$this->assertContains(htmlspecialchars($xssString), $content, 'Content must present');
40+
$this->assertNotContains($xssString, $content, 'Params must be escaped');
41+
$this->assertContains($block->escapeXssInUrl($xssString), $content, 'Content must be present');
42+
}
43+
44+
/**
45+
* @return array
46+
*/
47+
public function xssDataProvider()
48+
{
49+
return [
50+
['</script><script>alert("XSS")</script>'],
51+
['javascript%3Aalert%28String.fromCharCode%280x78%29%2BString.fromCharCode%280x73%29%2BString.'
52+
. 'fromCharCode%280x73%29%29'],
53+
['javascript:alert(String.fromCharCode(0x78)+String.fromCharCode(0x73)+String.fromCharCode(0x73))']
54+
];
3955
}
4056
}

‎dev/tools/Magento/Tools/Migration/factory_table_names/replace_ce.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -230,7 +230,6 @@
230230
'oauth/consumer' => 'oauth_consumer',
231231
'oauth/nonce' => 'oauth_nonce',
232232
'oauth/token' => 'oauth_token',
233-
'ogone/api_debug' => 'ogone_api_debug',
234233
'oscommerce/catalog_category' => 'catalog_category_entity',
235234
'oscommerce/catalog_product_website' => 'catalog_product_website',
236235
'oscommerce/oscommerce' => 'oscommerce_import',

‎lib/internal/Magento/Framework/Escaper.php

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,24 @@ public function escapeJsQuote($data, $quote = '\'')
7070
return $result;
7171
}
7272

73+
/**
74+
* Escape xss in urls
75+
*
76+
* @param string $data
77+
* @return string
78+
*/
79+
public function escapeXssInUrl($data)
80+
{
81+
$result = $data;
82+
$urlQuery = parse_url($data, PHP_URL_QUERY);
83+
if ($urlQuery !== null && strpos($urlQuery, 'javascript') !== false) {
84+
$result = str_replace($urlQuery, '', $data);
85+
} elseif (parse_url($data, PHP_URL_HOST) === null) {
86+
$result = str_replace('javascript', '', $data);
87+
}
88+
return htmlspecialchars($result, ENT_COMPAT, 'UTF-8', false);
89+
}
90+
7391
/**
7492
* Escape quotes inside html attributes
7593
* Use $addSlashes = false for escaping js that inside html attribute (onClick, onSubmit etc)

‎lib/internal/Magento/Framework/Test/Unit/EscaperTest.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,4 +92,16 @@ public function testEscapeQuote()
9292
$this->assertEquals($expected[0], $this->_escaper->escapeQuote($data));
9393
$this->assertEquals($expected[1], $this->_escaper->escapeQuote($data, true));
9494
}
95+
96+
/**
97+
* @covers \Magento\Framework\Escaper::escapeXssInUrl
98+
*/
99+
public function testEscapeXssInUrl()
100+
{
101+
$data = 'javascript%3Aalert%28String.fromCharCode%280x78%29%2BString.'
102+
. 'fromCharCode%280x73%29%2BString.fromCharCode%280x73%29%29';
103+
$expected = '%3Aalert%28String.fromCharCode%280x78%29%2BString.'
104+
. 'fromCharCode%280x73%29%2BString.fromCharCode%280x73%29%29';
105+
$this->assertEquals($expected, $this->_escaper->escapeXssInUrl($data));
106+
}
95107
}

‎lib/internal/Magento/Framework/View/Element/AbstractBlock.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -874,6 +874,17 @@ public function escapeUrl($data)
874874
return $this->_escaper->escapeUrl($data);
875875
}
876876

877+
/**
878+
* Escape xss in urls
879+
*
880+
* @param string $data
881+
* @return string
882+
*/
883+
public function escapeXssInUrl($data)
884+
{
885+
return $this->_escaper->escapeXssInUrl($data);
886+
}
887+
877888
/**
878889
* Escape quotes inside html attributes
879890
*

0 commit comments

Comments
 (0)