From a5ac9b82bd5c24b9f85e1ba819f3ad42b4719879 Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Thu, 25 Dec 2025 15:02:19 +0100 Subject: smarty: patch CVE-2018-25047 Details: https://nvd.nist.gov/vuln/detail/CVE-2018-25047 Pick the patch that resolved the issue referenced in the nvd report. Signed-off-by: Gyorgy Sarvari --- .../smarty/smarty/CVE-2018-25047.patch | 140 +++++++++++++++++++++ meta-oe/recipes-support/smarty/smarty_4.1.1.bb | 4 +- 2 files changed, 143 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-support/smarty/smarty/CVE-2018-25047.patch diff --git a/meta-oe/recipes-support/smarty/smarty/CVE-2018-25047.patch b/meta-oe/recipes-support/smarty/smarty/CVE-2018-25047.patch new file mode 100644 index 0000000000..caa48f8a4a --- /dev/null +++ b/meta-oe/recipes-support/smarty/smarty/CVE-2018-25047.patch @@ -0,0 +1,140 @@ +From 5f26e728152007aa57e415a5e3dd77542739aa13 Mon Sep 17 00:00:00 2001 +From: Simon Wisselink +Date: Wed, 14 Sep 2022 11:38:18 +0200 +Subject: [PATCH] Applied appropriate javascript and html escaping in mailto + plugin to counter injection attacks Fixes #454 + +CVE: CVE-2018-25047 +Upstream-Status: Backport [https://github.com/smarty-php/smarty/commit/55ea25d1f50f0406fb1ccedd212c527977793fc9] +Signed-off-by: Gyorgy Sarvari +--- + libs/plugins/function.mailto.php | 28 ++++++++++++------- + .../PluginFunctionMailtoTest.php | 21 ++++++++++++-- + 2 files changed, 37 insertions(+), 12 deletions(-) + +diff --git a/libs/plugins/function.mailto.php b/libs/plugins/function.mailto.php +index 834d0535..671ac069 100644 +--- a/libs/plugins/function.mailto.php ++++ b/libs/plugins/function.mailto.php +@@ -48,8 +48,13 @@ + */ + function smarty_function_mailto($params) + { +- static $_allowed_encoding = +- array('javascript' => true, 'javascript_charcode' => true, 'hex' => true, 'none' => true); ++ static $_allowed_encoding = [ ++ 'javascript' => true, ++ 'javascript_charcode' => true, ++ 'hex' => true, ++ 'none' => true ++ ]; ++ + $extra = ''; + if (empty($params[ 'address' ])) { + trigger_error("mailto: missing 'address' parameter", E_USER_WARNING); +@@ -57,19 +62,19 @@ function smarty_function_mailto($params) + } else { + $address = $params[ 'address' ]; + } ++ + $text = $address; ++ + // netscape and mozilla do not decode %40 (@) in BCC field (bug?) + // so, don't encode it. +- $search = array('%40', '%2C'); +- $replace = array('@', ','); +- $mail_parms = array(); ++ $mail_parms = []; + foreach ($params as $var => $value) { + switch ($var) { + case 'cc': + case 'bcc': + case 'followupto': + if (!empty($value)) { +- $mail_parms[] = $var . '=' . str_replace($search, $replace, rawurlencode($value)); ++ $mail_parms[] = $var . '=' . str_replace(['%40', '%2C'], ['@', ','], rawurlencode($value)); + } + break; + case 'subject': +@@ -83,6 +88,7 @@ function smarty_function_mailto($params) + default: + } + } ++ + if ($mail_parms) { + $address .= '?' . join('&', $mail_parms); + } +@@ -94,19 +100,21 @@ function smarty_function_mailto($params) + ); + return; + } ++ ++ $string = '' . htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, Smarty::$_CHARSET) . ''; ++ + if ($encode === 'javascript') { +- $string = '' . $text . ''; + $js_encode = ''; + for ($x = 0, $_length = strlen($string); $x < $_length; $x++) { + $js_encode .= '%' . bin2hex($string[ $x ]); + } + return ''; + } elseif ($encode === 'javascript_charcode') { +- $string = '' . $text . ''; + for ($x = 0, $_length = strlen($string); $x < $_length; $x++) { + $ord[] = ord($string[ $x ]); + } +- return ''; ++ return ''; + } elseif ($encode === 'hex') { + preg_match('!^(.*)(\?.*)$!', $address, $match); + if (!empty($match[ 2 ])) { +@@ -129,6 +137,6 @@ function smarty_function_mailto($params) + return '' . $text_encode . ''; + } else { + // no encoding +- return '' . $text . ''; ++ return $string; + } + } +diff --git a/tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionMailtoTest.php b/tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionMailtoTest.php +index bc5152a2..52b18ecc 100644 +--- a/tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionMailtoTest.php ++++ b/tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionMailtoTest.php +@@ -150,7 +150,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty + + public function testUmlauts() + { +- $result = 'me+smtpext@example.com'; ++ $result = 'me+smtpext@example.com'; + $tpl = $this->smarty->createTemplate('eval:{mailto address="me+smtpext@example.com" cc="you@example.com,they@example.com" subject="hällo wörld"}'); + $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl)); + } +@@ -158,9 +158,26 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty + public function testUmlautsWithoutMbstring() + { + Smarty::$_MBSTRING = false; +- $result = 'me+smtpext@example.com'; ++ $result = 'me+smtpext@example.com'; + $tpl = $this->smarty->createTemplate('eval:{mailto address="me+smtpext@example.com" cc="you@example.com,they@example.com" subject="hällo wörld"}'); + $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl)); + Smarty::$_MBSTRING = true; + } ++ ++ public function testJavascriptChars() ++ { ++ $result = ''; ++ $this->smarty->assign('address', 'me@example.com">me@example.com\'); alert("injection"); //'); ++ $tpl = $this->smarty->createTemplate('eval:{mailto address=$address encode=javascript}'); ++ $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl)); ++ } ++ ++ public function testHtmlChars() ++ { ++ $result = ''; ++ $this->smarty->assign('address', 'me@example.com">

'); ++ $tpl = $this->smarty->createTemplate('eval:{mailto address=$address extra=\'class="email"\'}'); ++ $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl)); ++ } ++ + } diff --git a/meta-oe/recipes-support/smarty/smarty_4.1.1.bb b/meta-oe/recipes-support/smarty/smarty_4.1.1.bb index df441e8db2..382f0f415c 100644 --- a/meta-oe/recipes-support/smarty/smarty_4.1.1.bb +++ b/meta-oe/recipes-support/smarty/smarty_4.1.1.bb @@ -7,7 +7,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2c0f216b2120ffc367e20f2b56df51b3" DEPENDS += "php" -SRC_URI = "git://github.com/smarty-php/smarty.git;protocol=https;branch=master" +SRC_URI = "git://github.com/smarty-php/smarty.git;protocol=https;branch=master \ + file://CVE-2018-25047.patch \ + " SRCREV = "71036be8be02bf93735c47b0b745f722efbc729f" -- cgit v1.2.3-54-g00ecf