From 88c1840894e49f6af3908cf6a350a9b9402cffe3 Mon Sep 17 00:00:00 2001
From: Sebastian Mendel <cybot_tm@users.sourceforge.net>
Date: Tue, 13 Mar 2007 14:21:31 +0000
Subject: [PATCH] bug #1679801 [core] XSS vulnerability in PMA_sanitize()

---
 ChangeLog                    |  2 ++
 libraries/sanitizing.lib.php | 26 +++++++++++++++++++++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index be6968b8f..da36ae4dd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,8 @@ phpMyAdmin - ChangeLog
 $Id$
 $Source$
 
+- bug #1679801 [core] XSS vulnerability in PMA_sanitize(), thanks to sp3x SecurityReason
+
 2007-03-01 Sebastian Mendel <cybot_tm@users.sourceforge.net>
     * libraries/common.lib.php: bug #1671813 CVE-2006-1549 deep recursion crash
 
diff --git a/libraries/sanitizing.lib.php b/libraries/sanitizing.lib.php
index b36af285a..6de0bbd74 100644
--- a/libraries/sanitizing.lib.php
+++ b/libraries/sanitizing.lib.php
@@ -34,7 +34,31 @@ function PMA_sanitize($message)
         '[br]'      => '<br />',
         '[/a]'      => '</a>',
     );
-    return preg_replace('/\[a@([^"@]*)@([^]"]*)\]/', '<a href="\1" target="\2">', strtr($message, $replace_pairs));
+    $sanitized_message = strtr($message, $replace_pairs);
+    $sanitized_message = preg_replace(
+        '/\[a@([^"@]*)@([^]"]*)\]/e',
+        '\'<a href="\' . PMA_sanitizeUri(\'$1\') . \'" target="\2">\'',
+        $sanitized_message);
+
+    return $sanitized_message;
 }
 
+/**
+ * removes javascript
+ *
+ * @uses    trim()
+ * @uses    strtolower()
+ * @uses    substr()
+ * @param   string  uri
+ */
+function PMA_sanitizeUri($uri)
+{
+    $uri = trim($uri);
+
+    if (strtolower(substr($uri, 0, 10)) === 'javascript') {
+        return '';
+    }
+
+    return $uri;
+}
 ?>