465530 - <iframe/> and <style/> tags are sanitized when "allow html" is checked

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Matthew Middleton (:zzxc)]

When attempting to edit the SFD4 page at http://support.mozilla.com/en-US/kb/SFD4 , the iframe and style tags used for page layout, and for embedding Mogulus and IRC, are sanitized by inserting <x> in the middle of the tag.  The SFD4 page can't be edited until this bug is fixed.

This bug is visible on the SFD4 staging page at http://support.mozilla.com/en-US/kb/SFD4-staging

Comment 1

[Laura Thomson :laura]

Caused by the new tiki2 sanitization code.  I'll see what I can do to that.

Comment 2

[Laura Thomson :laura]

This probably needs to be fixed in an off schedule push, BTW, or we can revert.  I'm marking it 0.7.3 for visibility though.

Comment 3

[Laura Thomson :laura]

Attachment: Exempt tiki-editpage from xss checking.

There is an additional layer of checking later in the code that will encode their HTML if they are not an admin anyway.

Comment 4

[Laura Thomson :laura]

Attachment: Better approach

For this one field, delay xss filtering until we know if the person's trusted to use HTML or not.  When we know, if they are not trusted, filter it then.

Comment 5

[Laura Thomson :laura]

In trunk r19999, in prod r20001 (just missed the big 20k!)

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Post-fix screenshot of test output

Testcase:

<iframe>Testing an iframe</iframe>

<p style="color: #090; line-height: 1.2">P</p>

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Looks fixed to me; Matthew, do you have cycles to confirm?

Comment 8

[Matthew Middleton (:zzxc)]

The SFD4 page works properly now when it is imported to support-stage.mozilla.org.  I'll verify this bug when it is pushed to production.

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #8)
> The SFD4 page works properly now when it is imported to
> support-stage.mozilla.org.  I'll verify this bug when it is pushed to
> production.

We pushed last night.

Comment 10

[Matthew Middleton (:zzxc)]

That push didn't happen until today, but regardless it is now working on production.

->verified

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

0.7.3 has come and gone, but thoughts of it still linger; I held a banger in my hand--has anyone seen my finger?

(Removing push-needed keyword since we shipped.)

Comment 12

[Marc Laporte]

Security model has changed for 3.x

Now, all plugin content which is potentially insecure must be approved by someone with sufficient perms. (tiki_p_plugin_approve)