Merge pull request #315 from trentm/xss-fix-retry

More robust XSS check
trentm · Dec 5, 2018 · 1fb702d · 1fb702d
2 parents 679d3da + c86fce7
commit 1fb702d
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/lib/markdown2.py b/lib/markdown2.py
@@ -2134,7 +2134,7 @@ def _encode_amps_and_angles(self, text):
         text = self._naked_gt_re.sub('&gt;', text)
         return text
 
-    _incomplete_tags_re = re.compile("<(/?\w+\s+)")
+    _incomplete_tags_re = re.compile("<(/?\w+[\s/]+?)")
 
     def _encode_incomplete_tags(self, text):
         if self.safe_mode not in ("replace", "escape"):

diff --git a/test/tm-cases/CVE-2018-5773.html b/test/tm-cases/CVE-2018-5773.html
@@ -1,3 +1,7 @@
 <p>&lt;img src="" onerror=alert(/XSS/) </p>
 
 <p>&lt;/img src="" onerror=alert(/XSS/) </p>
+
+<p>&lt;img/src="" onerror=alert(/XSS/) </p>
+
+<p>&lt;/img/src="" onerror=alert(/XSS/) </p>
diff --git a/test/tm-cases/CVE-2018-5773.text b/test/tm-cases/CVE-2018-5773.text
@@ -1,3 +1,7 @@
 <img src="" onerror=alert(/XSS/) 
 
 </img src="" onerror=alert(/XSS/) 
+
+<img/src="" onerror=alert(/XSS/) 
+
+</img/src="" onerror=alert(/XSS/)