f1b37a1aac
CVE num upstream commit openEuler patch CVE-2023-29400 9db0e74f606b8afb28cc71d4b1c8b4ed24cabbf5 0016-release-branch.go1.19-html-template-emit-filterFails.patch CVE-2023-24540 ce7bd33345416e6d8cac901792060591cafc2797 0015-release-branch.go1.19-html-template-handle-all-JS-wh.patch CVE-2023-24539 e49282327b05192e46086bf25fd3ac691205fe80 0014-release-branch.go1.19-html-template-disallow-angle-b.patch CVE-2023-24538 b1e3ecfa06b67014429a197ec5e134ce4303ad9b 0013-release-branch.go1.19-html-template-disallow-actions.patch CVE-2023-24537 126a1d02da82f93ede7ce0bd8d3c51ef627f2104 0012-release-branch.go1.19-go-scanner-reject-large-line-a.patch CVE-2023-24536 7917b5f31204528ea72e0629f0b7d52b35b27538 0011-release-branch.go1.19-mime-multipart-limit-parsed-mi.patch CVE-2023-24536 7a359a651c7ebdb29e0a1c03102fce793e9f58f0 0010-release-branch.go1.19-net-textproto-mime-multipart-i.patch CVE-2023-24536 ef41a4e2face45e580c5836eaebd51629fc23f15 0009-release-branch.go1.19-mime-multipart-avoid-excessive.patch CVE-2023-24534 d6759e7a059f4208f07aa781402841d7ddaaef96 0008-release-branch.go1.19-net-textproto-avoid-overpredic.patch CVE-2023-24532 639b67ed114151c0d786aa26e7faeab942400703 0007-release-branch.go1.19-crypto-internal-nistec-reduce-.patch CVE-2022-41723 5c3e11bd0b5c0a86e5beffcd4339b86a902b21c3 0006-release-branch.go1.19-net-http-update-bundled-golang.patch CVE-2022-41724 00b256e9e3c0fa02a278ec9dfc3e191e02ceaf80 0005-release-branch.go1.19-crypto-tls-replace-all-usages-.patch CVE-2022-41725 5c55ac9bf1e5f779220294c843526536605f42ab 0004-release-branch.go1.19-mime-multipart-limit-memory-in.patch CVE-2022-41722 3345ddca41f00f9ed6fc3c1a36f6e2bede02d7ff 0003-release-branch.go1.19-path-filepath-do-not-Clean-a-..patch Signed-off-by: zhangzhihui <zhangzhihui@xfusion.com>
64 lines
2.4 KiB
Diff
64 lines
2.4 KiB
Diff
From e49282327b05192e46086bf25fd3ac691205fe80 Mon Sep 17 00:00:00 2001
|
|
From: Roland Shoemaker <bracewell@google.com>
|
|
Date: Thu, 13 Apr 2023 15:40:44 -0700
|
|
Subject: [PATCH] [release-branch.go1.19] html/template: disallow angle
|
|
brackets in CSS values
|
|
|
|
Angle brackets should not appear in CSS contexts, as they may affect
|
|
token boundaries (such as closing a <style> tag, resulting in
|
|
injection). Instead emit filterFailsafe, matching the behavior for other
|
|
dangerous characters.
|
|
|
|
Thanks to Juho Nurminen of Mattermost for reporting this issue.
|
|
|
|
For #59720
|
|
Fixes #59811
|
|
Fixes CVE-2023-24539
|
|
|
|
Change-Id: Iccc659c9a18415992b0c05c178792228e3a7bae4
|
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1826636
|
|
Reviewed-by: Julie Qiu <julieqiu@google.com>
|
|
Run-TryBot: Roland Shoemaker <bracewell@google.com>
|
|
Reviewed-by: Damien Neil <dneil@google.com>
|
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1851496
|
|
Run-TryBot: Damien Neil <dneil@google.com>
|
|
Reviewed-by: Roland Shoemaker <bracewell@google.com>
|
|
Reviewed-on: https://go-review.googlesource.com/c/go/+/491335
|
|
Run-TryBot: Carlos Amedee <carlos@golang.org>
|
|
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
|
|
TryBot-Result: Gopher Robot <gobot@golang.org>
|
|
---
|
|
src/html/template/css.go | 2 +-
|
|
src/html/template/css_test.go | 2 ++
|
|
2 files changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/html/template/css.go b/src/html/template/css.go
|
|
index 890a0c6b22..f650d8b3e8 100644
|
|
--- a/src/html/template/css.go
|
|
+++ b/src/html/template/css.go
|
|
@@ -238,7 +238,7 @@ func cssValueFilter(args ...any) string {
|
|
// inside a string that might embed JavaScript source.
|
|
for i, c := range b {
|
|
switch c {
|
|
- case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}':
|
|
+ case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}', '<', '>':
|
|
return filterFailsafe
|
|
case '-':
|
|
// Disallow <!-- or -->.
|
|
diff --git a/src/html/template/css_test.go b/src/html/template/css_test.go
|
|
index a735638b03..2b76256a76 100644
|
|
--- a/src/html/template/css_test.go
|
|
+++ b/src/html/template/css_test.go
|
|
@@ -231,6 +231,8 @@ func TestCSSValueFilter(t *testing.T) {
|
|
{`-exp\000052 ession(alert(1337))`, "ZgotmplZ"},
|
|
{`-expre\0000073sion`, "-expre\x073sion"},
|
|
{`@import url evil.css`, "ZgotmplZ"},
|
|
+ {"<", "ZgotmplZ"},
|
|
+ {">", "ZgotmplZ"},
|
|
}
|
|
for _, test := range tests {
|
|
got := cssValueFilter(test.css)
|
|
--
|
|
2.37.1
|
|
|