1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138
|
!! replace prohibited word for prevent HTML and JavaScript Injection
!! see code injection samples here : https://www.codeproject.com/Articles/134024/HTML-and-JavaScript-Injection
!! all prohibited words must be set without CAPS
!! wims_read_parm input
!! word 1: two option words are possible:
!! - file (to make process on a file)
!! - variable (to make process on the content of script_data_input,
!! the result is in script_data_output)
!! word 2: (only if word 1 is file) is the name of the input file
!! word 3: (only if word 1 is file) is the name of the output file
!! additionnal word option can be pass in script_option:
!! - the word option "allowlink" means that the html links are left
!! as they are.
!! Warning this script should be use after msg2wims to protect tex formula
!! PS: there is a file named check_partialdetag in wimstest directory
!! with some general tests of the process.
!if allowlink notwordof $script_option
list_replace=/^\s*!insmath /!s/\shref\s*=/\ href\=/gi;\
/^ *!insmath /!s/<\s*a /\<a /gi;\
/^ *!insmath /!s/<\s*\/\s*a\s*>/\<\/a>/gi;
!else
list_replace=$empty
!endif
list_replace=!append line /^ *!insmath /!s/<\s*script\s*>/\<script>/gi;\
/^ *!insmath /!s/<\s*form\s*>/\<form>/gi;\
/^ *!insmath /!s/<\s*meta\s*/\<meta /gi;\
/^ *!insmath /!s/<\s*\/\s*script\s*>/\<\/script>/gi;\
/^ *!insmath /!s/<\s*\/\s*form\s*>/\<\/form>/gi;\
/^ *!insmath /!s/behavior:/\behavior\:/gi;\
/^ *!insmath /!s/javascript:/\javascript\:/gi;\
/^ *!insmath /!s/\s*onabort\s*=/ \onabort\=/gi;\
/^ *!insmath /!s/\s*class\s*=/ \class\=/gi;\
/^ *!insmath /!s/\s*onafterprint\s*=/ \onafterprint\=/gi;\
/^ *!insmath /!s/\s*onanimationend\s*=/ \onanimationend\=/gi;\
/^ *!insmath /!s/\s*onanimationiteration\s*=/ \onanimationiteration\=/gi;\
/^ *!insmath /!s/\s*onanimationstart\s*=/ \onanimationstart\=/gi;\
/^ *!insmath /!s/\s*onbeforeprint\s*=/ \onbeforeprint\=/gi;\
/^ *!insmath /!s/\s*onbeforeunload\s*=/ \onbeforeunload\=/gi;\
/^ *!insmath /!s/\s*onblur\s*=/ \onblur\=/gi;\
/^ *!insmath /!s/\s*oncanplay\s*=/ \oncanplay\=/gi;\
/^ *!insmath /!s/\s*oncanplaythrough\s*=/ \oncanplaythrough\=/gi;\
/^ *!insmath /!s/\s*onchange\s*=/ \onchange\=/gi;\
/^ *!insmath /!s/\s*onclick\s*=/ \onclick\=/gi;\
/^ *!insmath /!s/\s*oncontextmenu\s*=/ \oncontextmenu\=/gi;\
/^ *!insmath /!s/\s*oncopy\s*=/ \oncopy\=/gi;\
/^ *!insmath /!s/\s*oncut\s*=/ \oncut\=/gi;\
/^ *!insmath /!s/\s*ondblclick\s*=/ \ondblclick\=/gi;\
/^ *!insmath /!s/\s*ondrag\s*=/ \ondrag\=/gi;\
/^ *!insmath /!s/\s*ondragend\s*=/ \ondragend\=/gi;\
/^ *!insmath /!s/\s*ondragenter\s*=/ \ondragenter\=/gi;\
/^ *!insmath /!s/\s*ondragleave\s*=/ \ondragleave\=/gi;\
/^ *!insmath /!s/\s*ondragover\s*=/ \ondragover\=/gi;\
/^ *!insmath /!s/\s*ondragstart\s*=/ \ondragstart\=/gi;\
/^ *!insmath /!s/\s*ondrop\s*=/ \ondrop\=/gi;\
/^ *!insmath /!s/\s*ondurationchange\s*=/ \ondurationchange\=/gi;\
/^ *!insmath /!s/\s*onended\s*=/ \onended\=/gi;\
/^ *!insmath /!s/\s*onerror\s*=/ \onerror\=/gi;\
/^ *!insmath /!s/\s*onfocus\s*=/ \onfocus\=/gi;\
/^ *!insmath /!s/\s*onfocusin\s*=/ \onfocusin\=/gi;\
/^ *!insmath /!s/\s*onfocusout\s*=/ \onfocusout\=/gi;\
/^ *!insmath /!s/\s*onfullscreenchange\s*=/ \onfullscreenchange\=/gi;\
/^ *!insmath /!s/\s*onfullscreenerror\s*=/ \onfullscreenerror\=/gi;\
/^ *!insmath /!s/\s*onhashchange\s*=/ \onhashchange\=/gi;\
/^ *!insmath /!s/\s*oninput\s*=/ \oninput\=/gi;\
/^ *!insmath /!s/\s*oninvalid\s*=/ \oninvalid\=/gi;\
/^ *!insmath /!s/\s*onkeydown\s*=/ \onkeydown\=/gi;\
/^ *!insmath /!s/\s*onkeypress\s*=/ \onkeypress\=/gi;\
/^ *!insmath /!s/\s*onkeyup\s*=/ \onkeyup\=/gi;\
/^ *!insmath /!s/\s*onload\s*=/ \onload\=/gi;\
/^ *!insmath /!s/\s*onloadeddata\s*=/ \onloadeddata\=/gi;\
/^ *!insmath /!s/\s*onloadedmetadata\s*=/ \onloadedmetadata\=/gi;\
/^ *!insmath /!s/\s*onloadstart\s*=/ \onloadstart\=/gi;\
/^ *!insmath /!s/\s*onmessage\s*=/ \onmessage\=/gi;\
/^ *!insmath /!s/\s*onmousedown\s*=/ \onmousedown\=/gi;\
/^ *!insmath /!s/\s*onmouseenter\s*=/ \onmouseenter\=/gi;\
/^ *!insmath /!s/\s*onmouseleave\s*=/ \onmouseleave\=/gi;\
/^ *!insmath /!s/\s*onmousemove\s*=/ \onmousemove\=/gi;\
/^ *!insmath /!s/\s*onmouseover\s*=/ \onmouseover\=/gi;\
/^ *!insmath /!s/\s*onmouseout\s*=/ \onmouseout\=/gi;\
/^ *!insmath /!s/\s*onmouseup\s*=/ \onmouseup\=/gi;\
/^ *!insmath /!s/\s*onmousewheel\s*=/ \onmousewheel\=/gi;\
/^ *!insmath /!s/\s*onoffline\s*=/ \onoffline\=/gi;\
/^ *!insmath /!s/\s*ononline\s*=/ \ononline\=/gi;\
/^ *!insmath /!s/\s*onopen\s*=/ \onopen\=/gi;\
/^ *!insmath /!s/\s*onpagehide\s*=/ \onpagehide\=/gi;\
/^ *!insmath /!s/\s*onpageshow\s*=/ \onpageshow\=/gi;\
/^ *!insmath /!s/\s*onpaste\s*=/ \onpaste\=/gi;\
/^ *!insmath /!s/\s*onpause\s*=/ \onpause\=/gi;\
/^ *!insmath /!s/\s*onplay\s*=/ \onplay\=/gi;\
/^ *!insmath /!s/\s*onplaying\s*=/ \onplaying\=/gi;\
/^ *!insmath /!s/\s*onpopstate\s*=/ \onpopstate\=/gi;\
/^ *!insmath /!s/\s*onprogress\s*=/ \onprogress\=/gi;\
/^ *!insmath /!s/\s*onratechange\s*=/ \onratechange\=/gi;\
/^ *!insmath /!s/\s*onresize\s*=/ \onresize\=/gi;\
/^ *!insmath /!s/\s*onreset\s*=/ \onreset\=/gi;\
/^ *!insmath /!s/\s*onscroll\s*=/ \onscroll\=/gi;\
/^ *!insmath /!s/\s*onsearch\s*=/ \onsearch\=/gi;\
/^ *!insmath /!s/\s*onseeked\s*=/ \onseeked\=/gi;\
/^ *!insmath /!s/\s*onseeking\s*=/ \onseeking\=/gi;\
/^ *!insmath /!s/\s*onselect\s*=/ \onselect\=/gi;\
/^ *!insmath /!s/\s*onshow\s*=/ \onshow\=/gi;\
/^ *!insmath /!s/\s*onstalled\s*=/ \onstalled\=/gi;\
/^ *!insmath /!s/\s*onstorage\s*=/ \onstorage\=/gi;\
/^ *!insmath /!s/\s*onsubmit\s*=/ \onsubmit\=/gi;\
/^ *!insmath /!s/\s*onsuspend\s*=/ \onsuspend\=/gi;\
/^ *!insmath /!s/\s*ontimeupdate\s*=/ \ontimeupdate\=/gi;\
/^ *!insmath /!s/\s*ontoggle\s*=/ \ontoggle\=/gi;\
/^ *!insmath /!s/\s*ontouchcancel\s*=/ \ontouchcancel\=/gi;\
/^ *!insmath /!s/\s*ontouchend\s*=/ \ontouchend\=/gi;\
/^ *!insmath /!s/\s*ontouchmove\s*=/ \ontouchmove\=/gi;\
/^ *!insmath /!s/\s*ontouchstart\s*=/ \ontouchstart\=/gi;\
/^ *!insmath /!s/\s*ontransitionend\s*=/ \ontransitionend\=/gi;\
/^ *!insmath /!s/\s*onunload\s*=/ \onunload\=/gi;\
/^ *!insmath /!s/\s*onvolumechange\s*=/ \onvolumechange\=/gi;\
/^ *!insmath /!s/\s*onwaiting\s*=/ \onwaiting\=/gi;\
/^ *!insmath /!s/\s*onwheel\s*=/ \onwheel\=/gi to $list_replace
!distribute word $wims_read_parm into option_,file_,ofile_
!default ofile_=$file_
!if $option_=file
!sh mkdir -p $wims_home/tmp/sessions/$wims_session/ ;\
sed '$list_replace' $file_ > $wims_home/tmp/sessions/$wims_session/partialdetag.tmp;\
mv $wims_home/tmp/sessions/$wims_session/partialdetag.tmp $ofile_;
!exit
!endif
!if $option_=variable
!writefile wimshome/s2/$wims_session/tmpdetag $script_data_input
script_data_output=!sh sed '$list_replace' $wims_home/s2/$wims_session/tmpdetag;\
rm -f $wims_home/s2/$wims_session/tmpdetag;
!exit
!endif
!reset script_option
|