@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Fix an XSS issue where Diffusion files exceeding the highlighting byte limit were not properly escaped
Fixes T11257.
Auditors: chad
+8
-4
+8
-4
src/applications/diffusion/controller/DiffusionBrowseController.php
+8
-4
src/applications/diffusion/controller/DiffusionBrowseController.php
···
682
682
$blame_commits,
683
683
$show_blame);
684
684
} else {
685
-
if ($can_highlight) {
686
-
require_celerity_resource('syntax-highlighting-css');
685
+
require_celerity_resource('syntax-highlighting-css');
687
686
687
+
if (!$can_highlight) {
688
688
$highlighted = PhabricatorSyntaxHighlighter::highlightWithFilename(
689
689
$path,
690
690
$file_corpus);
691
-
$lines = phutil_split_lines($highlighted);
692
691
} else {
693
-
$lines = phutil_split_lines($file_corpus);
692
+
// Highlight as plain text to escape the content properly.
693
+
$highlighted = PhabricatorSyntaxHighlighter::highlightWithLanguage(
694
+
'txt',
695
+
$file_corpus);
694
696
}
697
+
698
+
$lines = phutil_split_lines($highlighted);
695
699
696
700
$rows = $this->buildDisplayRows(
697
701
$lines,