Skip to content

Commit ce50dae

Browse files
svitjasvitja
committed
MAGETWO-81503: XSS in Sales
1 parent e669d9d commit ce50dae

File tree

4 files changed

+77
-6
lines changed

4 files changed

+77
-6
lines changed

‎app/code/Magento/Backend/Block/Widget/Grid/Column/Filter/Date.php

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ public function getHtml()
127127

128128
/**
129129
* @param string|null $index
130-
* @return string
130+
* @return array|string|int|float|null
131131
*/
132132
public function getEscapedValue($index = null)
133133
{
@@ -138,6 +138,11 @@ public function getEscapedValue($index = null)
138138
$this->_localeDate->getDateFormat(\IntlDateFormatter::SHORT)
139139
);
140140
}
141+
142+
if (is_string($value)) {
143+
return $this->escapeHtml($value);
144+
}
145+
141146
return $value;
142147
}
143148

‎app/code/Magento/Backend/Block/Widget/Grid/Column/Filter/Datetime.php

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@ public function getHtml()
140140
/**
141141
* Return escaped value for calendar
142142
*
143-
* @param string $index
144-
* @return string
143+
* @param string|null $index
144+
* @return array|string|int|float|null
145145
*/
146146
public function getEscapedValue($index = null)
147147
{
@@ -150,6 +150,11 @@ public function getEscapedValue($index = null)
150150
if ($value instanceof \DateTimeInterface) {
151151
return $this->_localeDate->formatDateTime($value);
152152
}
153+
154+
if (is_string($value)) {
155+
return $this->escapeHtml($value);
156+
}
157+
153158
return $value;
154159
}
155160

‎app/code/Magento/Backend/Test/Unit/Block/Widget/Grid/Column/Filter/DateTest.php

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ class DateTest extends \PHPUnit\Framework\TestCase
3030
/** @var \Magento\Framework\Stdlib\DateTime\TimezoneInterface|\PHPUnit_Framework_MockObject_MockObject */
3131
protected $localeDateMock;
3232

33+
/** @var \Magento\Framework\Escaper|\PHPUnit_Framework_MockObject_MockObject */
34+
private $escaperMock;
35+
36+
/** @var \Magento\Backend\Block\Context|\PHPUnit_Framework_MockObject_MockObject */
37+
private $contextMock;
38+
3339
protected function setUp()
3440
{
3541
$this->mathRandomMock = $this->getMockBuilder(\Magento\Framework\Math\Random::class)
@@ -58,14 +64,26 @@ protected function setUp()
5864
->setMethods([])
5965
->getMock();
6066

67+
$this->escaperMock = $this->getMockBuilder(\Magento\Framework\Escaper::class)
68+
->disableOriginalConstructor()
69+
->getMock();
70+
71+
$this->contextMock = $this->getMockBuilder(\Magento\Backend\Block\Context::class)
72+
->disableOriginalConstructor()
73+
->getMock();
74+
75+
$this->contextMock->expects($this->once())->method('getEscaper')->willReturn($this->escaperMock);
76+
$this->contextMock->expects($this->once())->method('getLocaleDate')->willReturn($this->localeDateMock);
77+
6178
$objectManagerHelper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
6279
$this->model = $objectManagerHelper->getObject(
6380
\Magento\Backend\Block\Widget\Grid\Column\Filter\Date::class,
6481
[
6582
'mathRandom' => $this->mathRandomMock,
6683
'localeResolver' => $this->localeResolverMock,
6784
'dateTimeFormatter' => $this->dateTimeFormatterMock,
68-
'localeDate' => $this->localeDateMock
85+
'localeDate' => $this->localeDateMock,
86+
'context' => $this->contextMock,
6987
]
7088
);
7189
$this->model->setColumn($this->columnMock);
@@ -98,4 +116,16 @@ public function testGetHtmlSuccessfulTimestamp()
98116
$this->assertContains('id="' . $uniqueHash . '_from" value="' . $yesterday->getTimestamp(), $output);
99117
$this->assertContains('id="' . $uniqueHash . '_to" value="' . $tomorrow->getTimestamp(), $output);
100118
}
119+
120+
public function testGetEscapedValueEscapeString()
121+
{
122+
$value = "\"><img src=x onerror=alert(2) />";
123+
$array = [
124+
'orig_from' => $value,
125+
'from' => $value,
126+
];
127+
$this->model->setValue($array);
128+
$this->escaperMock->expects($this->once())->method('escapeHtml')->with($value);
129+
$this->model->getEscapedValue('from');
130+
}
101131
}

‎app/code/Magento/Backend/Test/Unit/Block/Widget/Grid/Column/Filter/DatetimeTest.php

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ class DatetimeTest extends \PHPUnit\Framework\TestCase
3030
/** @var \Magento\Framework\Stdlib\DateTime\TimezoneInterface|\PHPUnit_Framework_MockObject_MockObject */
3131
protected $localeDateMock;
3232

33+
/** @var \Magento\Framework\Escaper|\PHPUnit_Framework_MockObject_MockObject */
34+
private $escaperMock;
35+
36+
/** @var \Magento\Backend\Block\Context|\PHPUnit_Framework_MockObject_MockObject */
37+
private $contextMock;
38+
3339
protected function setUp()
3440
{
3541
$this->mathRandomMock = $this->getMockBuilder(\Magento\Framework\Math\Random::class)
@@ -50,22 +56,34 @@ protected function setUp()
5056

5157
$this->columnMock = $this->getMockBuilder(\Magento\Backend\Block\Widget\Grid\Column::class)
5258
->disableOriginalConstructor()
53-
->setMethods(['getTimezone', 'getHtmlId', 'getId'])
59+
->setMethods(['getTimezone', 'getHtmlId', 'getId', 'getFilterTime'])
5460
->getMock();
5561

5662
$this->localeDateMock = $this->getMockBuilder(\Magento\Framework\Stdlib\DateTime\TimezoneInterface::class)
5763
->disableOriginalConstructor()
5864
->setMethods([])
5965
->getMock();
6066

67+
$this->escaperMock = $this->getMockBuilder(\Magento\Framework\Escaper::class)
68+
->disableOriginalConstructor()
69+
->getMock();
70+
71+
$this->contextMock = $this->getMockBuilder(\Magento\Backend\Block\Context::class)
72+
->disableOriginalConstructor()
73+
->getMock();
74+
75+
$this->contextMock->expects($this->once())->method('getEscaper')->willReturn($this->escaperMock);
76+
$this->contextMock->expects($this->once())->method('getLocaleDate')->willReturn($this->localeDateMock);
77+
6178
$objectManagerHelper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
6279
$this->model = $objectManagerHelper->getObject(
6380
\Magento\Backend\Block\Widget\Grid\Column\Filter\Datetime::class,
6481
[
6582
'mathRandom' => $this->mathRandomMock,
6683
'localeResolver' => $this->localeResolverMock,
6784
'dateTimeFormatter' => $this->dateTimeFormatterMock,
68-
'localeDate' => $this->localeDateMock
85+
'localeDate' => $this->localeDateMock,
86+
'context' => $this->contextMock,
6987
]
7088
);
7189
$this->model->setColumn($this->columnMock);
@@ -98,4 +116,17 @@ public function testGetHtmlSuccessfulTimestamp()
98116
$this->assertContains('id="' . $uniqueHash . '_from" value="' . $yesterday->getTimestamp(), $output);
99117
$this->assertContains('id="' . $uniqueHash . '_to" value="' . $tomorrow->getTimestamp(), $output);
100118
}
119+
120+
public function testGetEscapedValueEscapeString()
121+
{
122+
$value = "\"><img src=x onerror=alert(2) />";
123+
$array = [
124+
'orig_from' => $value,
125+
'from' => $value,
126+
];
127+
$this->model->setValue($array);
128+
$this->escaperMock->expects($this->once())->method('escapeHtml')->with($value);
129+
$this->columnMock->expects($this->once())->method('getFilterTime')->willReturn(true);
130+
$this->model->getEscapedValue('from');
131+
}
101132
}

0 commit comments

Comments
 (0)