diff --git a/tests/view/SSViewerTest.php b/tests/view/SSViewerTest.php
index d8349c50d..550eaa046 100644
--- a/tests/view/SSViewerTest.php
+++ b/tests/view/SSViewerTest.php
@@ -1131,8 +1131,10 @@ after')
public function testRewriteHashlinks() {
$orig = Config::inst()->get('SSViewer', 'rewrite_hash_links');
- Config::inst()->update('SSViewer', 'rewrite_hash_links', true);
-
+ Config::inst()->update('SSViewer', 'rewrite_hash_links', true);
+
+ $_SERVER['REQUEST_URI'] = 'http://path/to/file?foo"onclick="alert(\'xss\')""';
+
// Emulate SSViewer::process()
$base = Convert::raw2att($_SERVER['REQUEST_URI']);
@@ -1143,6 +1145,8 @@ after')
<% base_tag %>
+ ExternalInlineLink
+ $ExternalInsertedLink
InlineLink
$InsertedLink
@@ -1151,15 +1155,24 @@ after')
$tmpl = new SSViewer($tmplFile);
$obj = new ViewableData();
$obj->InsertedLink = 'InsertedLink';
+ $obj->ExternalInsertedLink = 'ExternalInsertedLink';
$result = $tmpl->process($obj);
$this->assertContains(
'InsertedLink',
$result
);
+ $this->assertContains(
+ 'ExternalInsertedLink',
+ $result
+ );
$this->assertContains(
'InlineLink',
$result
);
+ $this->assertContains(
+ 'ExternalInlineLink',
+ $result
+ );
$this->assertContains(
'',
$result,
@@ -1192,7 +1205,7 @@ after')
$obj->InsertedLink = 'InsertedLink';
$result = $tmpl->process($obj);
$this->assertContains(
- 'get(\'SSViewer\', \'rewrite_hash_links\') ?' .
- ' strip_tags( $_SERVER[\'REQUEST_URI\'] ) : "") .
+ ' Convert::raw2att( $_SERVER[\'REQUEST_URI\'] ) : "") .
\'#',
$text
);
diff --git a/view/SSTemplateParser.php.inc b/view/SSTemplateParser.php.inc
index 74fc27bbe..6bb7c550d 100644
--- a/view/SSTemplateParser.php.inc
+++ b/view/SSTemplateParser.php.inc
@@ -1138,7 +1138,7 @@ class SSTemplateParser extends Parser implements TemplateParser {
$text = preg_replace(
'/(]+href *= *)"#/i',
'\\1"\' . (Config::inst()->get(\'SSViewer\', \'rewrite_hash_links\') ?' .
- ' strip_tags( $_SERVER[\'REQUEST_URI\'] ) : "") .
+ ' Convert::raw2att( $_SERVER[\'REQUEST_URI\'] ) : "") .
\'#',
$text
);
diff --git a/view/SSViewer.php b/view/SSViewer.php
index 8a4ebf052..d5fdb68bb 100644
--- a/view/SSViewer.php
+++ b/view/SSViewer.php
@@ -1109,9 +1109,9 @@ class SSViewer implements Flushable {
if($this->rewriteHashlinks && $rewrite) {
if(strpos($output, ']+href *= *)"#/i', '\\1"' . $thisURLRelativeToBase . '#', $output);