From e5cc4d513b6f879037eeac1ec20ae66e535585cb Mon Sep 17 00:00:00 2001
From: Oliver Hader <oliver@typo3.org>
Date: Thu, 26 Aug 2021 10:15:01 +0200
Subject: [PATCH] [TASK] Upgrade to typo3/html-sanitizer v2.0.10
composer req typo3/html-sanitizer:^2.0.10;\
composer req typo3/html-sanitizer:^2.0.10 \
-d typo3/sysext/core --no-update
Resolves: #95000
Releases: master, 11.3, 10.4, 9.5
Change-Id: Ia2170f6bd6f3bace862fac124ef8cc2966d35171
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70763
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Andreas Fernandez <a.fernandez@scripting-base.de>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Andreas Fernandez <a.fernandez@scripting-base.de>
---
composer.json | 2 +-
composer.lock | 14 +++++++-------
.../DataHandling/DataHandler/SecurityTest.php | 4 ++--
typo3/sysext/core/composer.json | 2 +-
4 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/composer.json b/composer.json
index 6344cd143939..1cf3959f5317 100644
--- a/composer.json
+++ b/composer.json
@@ -83,7 +83,7 @@
"typo3/class-alias-loader": "^1.0",
"typo3/cms-cli": "^3.0",
"typo3/cms-composer-installers": "^2.0 || ^3.0",
- "typo3/html-sanitizer": "^2.0.9",
+ "typo3/html-sanitizer": "^2.0.10",
"typo3/phar-stream-wrapper": "^3.1.6",
"typo3/symfony-psr-event-dispatcher-adapter": "^1.0 || ^2.0",
"typo3fluid/fluid": "^2.7.0"
diff --git a/composer.lock b/composer.lock
index de3cb1b83645..e3dfdf304e40 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
- "content-hash": "1829a3e70a84bfe469ad61f6b1a372e8",
+ "content-hash": "5f735b56f523e7891b4c7a42c483dcdb",
"packages": [
{
"name": "bacon/bacon-qr-code",
@@ -4925,16 +4925,16 @@
},
{
"name": "typo3/html-sanitizer",
- "version": "v2.0.9",
+ "version": "v2.0.10",
"source": {
"type": "git",
"url": "https://github.com/TYPO3/html-sanitizer.git",
- "reference": "5dfd055b3d62a505d6dd8381f3145d17147ceb6d"
+ "reference": "b9267c3b19ae1271b6c3f676f287e778977ca324"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/TYPO3/html-sanitizer/zipball/5dfd055b3d62a505d6dd8381f3145d17147ceb6d",
- "reference": "5dfd055b3d62a505d6dd8381f3145d17147ceb6d",
+ "url": "https://api.github.com/repos/TYPO3/html-sanitizer/zipball/b9267c3b19ae1271b6c3f676f287e778977ca324",
+ "reference": "b9267c3b19ae1271b6c3f676f287e778977ca324",
"shasum": ""
},
"require": {
@@ -4970,9 +4970,9 @@
"description": "HTML sanitizer aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.",
"support": {
"issues": "https://github.com/TYPO3/html-sanitizer/issues",
- "source": "https://github.com/TYPO3/html-sanitizer/tree/v2.0.9"
+ "source": "https://github.com/TYPO3/html-sanitizer/tree/v2.0.10"
},
- "time": "2021-08-16T10:44:16+00:00"
+ "time": "2021-08-25T11:05:47+00:00"
},
{
"name": "typo3/phar-stream-wrapper",
diff --git a/typo3/sysext/core/Tests/Functional/DataHandling/DataHandler/SecurityTest.php b/typo3/sysext/core/Tests/Functional/DataHandling/DataHandler/SecurityTest.php
index 96cb9c6bff90..fe51ab498bf4 100644
--- a/typo3/sysext/core/Tests/Functional/DataHandling/DataHandler/SecurityTest.php
+++ b/typo3/sysext/core/Tests/Functional/DataHandling/DataHandler/SecurityTest.php
@@ -193,7 +193,7 @@ class SecurityTest extends FunctionalTestCase
'<font face="a" color="b" onmouseover="alert(1);">text</font>'
. '<img src="x" alt="test" onerror="alert(2)">',
[
- '<font face="a" color="b" onmouseover="alert(1);">text</font>'
+ '<font face="a" color="b">text</font>'
. '<img src="x" alt="test">',
// @todo "expected" for the time being without using HTML Sanitizer
'<font face="a" color="b" onmouseover="alert(1);">text</font>'
@@ -206,7 +206,7 @@ class SecurityTest extends FunctionalTestCase
. '<img src="x" alt="test" onerror="alert(2)">'
. '</p>',
[
- '<p><font face="a" color="b" onmouseover="alert(1);">text</font>'
+ '<p><font face="a" color="b">text</font>'
. '<img src="x" alt="test"></p>',
// @todo "expected" for the time being without using HTML Sanitizer
'<p><font face="a" color="b" onmouseover="alert(1);">text</font>'
diff --git a/typo3/sysext/core/composer.json b/typo3/sysext/core/composer.json
index cf7f9508e2c3..d2f605e0a559 100644
--- a/typo3/sysext/core/composer.json
+++ b/typo3/sysext/core/composer.json
@@ -67,7 +67,7 @@
"typo3/class-alias-loader": "^1.0",
"typo3/cms-cli": "^3.0",
"typo3/cms-composer-installers": "^2.0 || ^3.0",
- "typo3/html-sanitizer": "^2.0.9",
+ "typo3/html-sanitizer": "^2.0.10",
"typo3/phar-stream-wrapper": "^3.1.6",
"typo3/symfony-psr-event-dispatcher-adapter": "^1.0 || ^2.0",
"typo3fluid/fluid": "^2.7.0"
--
GitLab