From 563a4ac21edeb9891bd8d69923708a9b05de3a03 Mon Sep 17 00:00:00 2001 From: Christian Beeznest Date: Fri, 16 Oct 2026 01:38:00 -0500 Subject: [PATCH] Security: Harden HTML event attribute filtering - refs GHSA-9wff-vv7j-p3cc --- .../HTMLPurifier/Filter/RemoveOnAttributes.php | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/Chamilo/CoreBundle/Component/HTMLPurifier/Filter/RemoveOnAttributes.php b/src/Chamilo/CoreBundle/Component/HTMLPurifier/Filter/RemoveOnAttributes.php index 3447b5f39e5..7a7ef925ee5 100644 --- a/src/Chamilo/CoreBundle/Component/HTMLPurifier/Filter/RemoveOnAttributes.php +++ b/src/Chamilo/CoreBundle/Component/HTMLPurifier/Filter/RemoveOnAttributes.php @@ -17,10 +17,16 @@ public function preFilter($html, $config, $context) public static function filter($html) { - // Strip null bytes before regex matching to prevent bypass via on\x00load patterns + // Strip null bytes before regex matching to prevent bypass via on\x00load patterns. $html = str_replace("\0", '', $html); - $pattern = '/\s+on\w+\s*=\s*(?:"[^"]*"|\'[^\']*\'|[^\s>]+)/i'; + $pattern = '/(?:=\s*(?:"[^"]*"|\'[^\']*\'|[^\s>]+))(*SKIP)(*F)|(?:\s+|\/+|(?<=["\']))on\w+\s*=\s*(?:"[^"]*"|\'[^\']*\'|[^\s>]+)/i'; - return preg_replace($pattern, '', $html); + return preg_replace_callback( + '/<(?:[^>"\']+|"[^"]*"|\'[^\']*\')*>/s', + function ($matches) use ($pattern) { + return preg_replace($pattern, '', $matches[0]); + }, + $html + ); } }