Merge remote-tracking branch 'security/3.5.4' into 3.6.0

.travis.yml

@@ -12,7 +12,7 @@ addons:
 
 env:
   global:
-    - CORE_RELEASE=3
+    - CORE_RELEASE=3.5
 
 matrix:
   include:

code/controllers/CMSPageHistoryController.php

@@ -470,10 +470,6 @@ class CMSPageHistoryController extends CMSMain {
 				"Version" => $fromVersion,
 			));
 
-			foreach($form->Fields()->dataFields() as $field) {
-				$field->dontEscape = true;
-			}
-
 			return $form;
 		}
 

code/model/RedirectorPage.php

@@ -106,13 +106,23 @@ class RedirectorPage extends Page {
 	public function onBeforeWrite() {
 		parent::onBeforeWrite();
 
-		// Prefix the URL with "http://" if no prefix is found
+		if ($this->ExternalURL && substr($this->ExternalURL, 0, 2) !== '//') {
-		if(
+			$urlParts = parse_url($this->ExternalURL);
-			$this->ExternalURL
+			if ($urlParts) {
-			&& !parse_url($this->ExternalURL, PHP_URL_SCHEME)
+				if (empty($urlParts['scheme'])) {
-			&& !preg_match('#^//#', $this->ExternalURL)
+					// no scheme, assume http
-		) {
 					$this->ExternalURL = 'http://' . $this->ExternalURL;
+				} elseif (!in_array($urlParts['scheme'], array(
+					'http',
+					'https',
+				))) {
+					// we only allow http(s) urls
+					$this->ExternalURL = '';
+				}
+			} else {
+				// malformed URL to reject
+				$this->ExternalURL = '';
+			}
 		}
 	}
 

tests/model/RedirectorPageTest.php

@@ -80,6 +80,17 @@ class RedirectorPageTest extends FunctionalTest {
 		RedirectorPage_Controller::remove_extension('RedirectorPageTest_RedirectExtension');
 	}
 
+	public function testNoJSLinksAllowed()
+	{
+		$page = new RedirectorPage();
+		$js = 'javascript:alert("hello world")';
+		$page->ExternalURL = $js;
+		$this->assertEquals($js, $page->ExternalURL);
+
+		$page->write();
+		$this->assertEmpty($page->ExternalURL);
+	}
+
 }
 
 class RedirectorPageTest_RedirectExtension extends Extension implements TestOnly {