mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-07-29 16:27:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Simplepie: fix sanitizer whitelist stripping order (#9066)

Browse Source 
* Simplepie: fix sanitizer whitelist stripping order

Includes <https://github.com/FreshRSS/simplepie/pull/85>.

Fixes <https://github.com/FreshRSS/FreshRSS/issues/9052>.

* composer update --no-autoloader
This commit is contained in:
Frans de Jonge
2026-07-19 11:50:56 +02:00
committed by GitHub
parent 7c7fc8b35d
commit bffd20ba01
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/composer.json
View File

@@ -18,7 +18,7 @@
"marienfressinaud/lib_opml": "dev-main#f0e850b6394af90b898daf0e65fcc7363457b844",
"phpgt/cssxpath": "v1.5.0",
"phpmailer/phpmailer": "7.1.1",
"simplepie/simplepie": "dev-freshrss#2d4c5b99b8f851b1e416b84f6a9a1e85097b9012"
"simplepie/simplepie": "dev-freshrss#5c4cd94907c066f1db5ccd9c6d4610ecba114e39"
},
"config": {
"sort-packages": true,

14
lib/simplepie/simplepie/src/Sanitize.php
View File

@@ -721,16 +721,18 @@ class Sanitize implements RegistryAware
&& !isset($this->allowed_html_elements_with_attributes[$tag])) {
if (!in_array($tag, ['script', 'style', 'svg', 'math', 'template'], true)) {
// Preserve children inside the disallowed element
for ($i = $element->childNodes->length - 1; $i >= 0; $i--) {
$child = $element->childNodes->item($i);
if ($child === null) {
continue;
}
$nextSibling = $element->nextSibling;
while ($element->firstChild !== null) {
$child = $element->firstChild;
if ($child instanceof \DOMText) {
$child->nodeValue = htmlspecialchars($child->nodeValue ?? '', ENT_QUOTES, 'UTF-8');
}
if ($parent !== null) {
$parent->insertBefore($child, $element);
if ($nextSibling !== null) {
$parent->insertBefore($child, $nextSibling);
} else {
$parent->appendChild($child);
}
}
$this->enforce_allowed_html_nodes($child, $allow_data_attr, $allow_aria_attr);
}