diff --git a/src/Netcarver/Textile/Parser.php b/src/Netcarver/Textile/Parser.php index d86f8502..ac99111d 100644 --- a/src/Netcarver/Textile/Parser.php +++ b/src/Netcarver/Textile/Parser.php @@ -765,6 +765,14 @@ class Parser protected $tag_index = 1; + /** + * Span reference token prefix. + * + * @var string + */ + + protected $spanReferenceTokenPrefix; + /** * Constructor. * @@ -1036,6 +1044,14 @@ public function textileRestricted($text, $lite = true, $noimage = true, $rel = ' protected function textileCommon($text, $lite) { + while (1) { + $this->spanReferenceTokenPrefix = 'textile' . uniqid(rand()); + + if (strpos($text, $this->spanReferenceTokenPrefix) === false) { + break; + } + } + if ($lite) { $this->blocktag_whitelist = array('bq', 'p'); $text = $this->blocks($text."\n\n"); @@ -2129,8 +2145,8 @@ protected function storeTags($opentag, $closetag = '') $key = str_pad((string) $key, 10, '0', STR_PAD_LEFT).'z'; // $key must be of fixed length to allow proper matching in retrieveTags $this->tagCache[$key] = array('open' => $opentag, 'close' => $closetag); $tags = array( - 'open' => "textileopentag{$key} ", - 'close' => " textileclosetag{$key}", + 'open' => "{$this->spanReferenceTokenPrefix}opentag{$key} ", + 'close' => " {$this->spanReferenceTokenPrefix}closetag{$key}", ); return $tags; } @@ -2138,8 +2154,8 @@ protected function storeTags($opentag, $closetag = '') protected function retrieveTags($text) { - $text = preg_replace_callback('/textileopentag([\d]{10}z) /', array(&$this, 'fRetrieveOpenTags'), $text); - $text = preg_replace_callback('/ textileclosetag([\d]{10}z)/', array(&$this, 'fRetrieveCloseTags'), $text); + $text = preg_replace_callback('/'.$this->spanReferenceTokenPrefix.'opentag([\d]{10}z) /', array(&$this, 'fRetrieveOpenTags'), $text); + $text = preg_replace_callback('/ '.$this->spanReferenceTokenPrefix.'closetag([\d]{10}z)/', array(&$this, 'fRetrieveCloseTags'), $text); return $text; } diff --git a/test/basic.yaml b/test/basic.yaml index 35eca126..65015fbf 100644 --- a/test/basic.yaml +++ b/test/basic.yaml @@ -3151,4 +3151,10 @@ Restricted mode security filtering mode with default options :

“javascript link”:javacript:window.alert()

-

notextile. <iframe src=“xss/attempt”></iframe><&#123><script>window.alert(‘success’)</script>

\ No newline at end of file +

notextile. <iframe src=“xss/attempt”></iframe><&#123><script>window.alert(‘success’)</script>

+ +Token references : + input : | + Hello textileopentag0000000001z World! + expect : | +

Hello textileopentag0000000001z World!

\ No newline at end of file