CVE-2016-7149: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-01-18T17:59Z
Repository: https://github.com/b2evolution/b2evolution
Language: PHP
Files changed: _tests/blogs/evocore/misc.funcs.simpletest.php, inc/_core/_misc.funcs.php
Commit date: 2016-08-12 18:11:18 +0300
Commit message: Fix autolink function to avoid XSS issue

Diff: diff --git a/_tests/blogs/evocore/misc.funcs.simpletest.php b/_tests/blogs/evocore/misc.funcs.simpletest.php
index cd2fe71cb..a58d5b943 100644
--- a/_tests/blogs/evocore/misc.funcs.simpletest.php
+++ b/_tests/blogs/evocore/misc.funcs.simpletest.php
@@ -52,10 +52,13 @@ class MiscFuncsTestCase extends EvoUnitTestCase
 				'wanna chat? icq:878787.' => 'wanna chat? <a href="http://wwp.icq.com/scripts/search.dll?to=878787">878787</a>.',
 
 				'<img src="http://example.com/" />' => '<img src="http://example.com/" />',
 				'<img src=http://example.com/ />' => '<img src=http://example.com/ />',
 				'<div>http://example.com/</div>' => '<div><a href="http://example.com/">http://example.com/</a></div>',
+
+				// XSS sample:
+				'text http://test_url.test"onmouseover="alert(1)"onerror=1 "text' => 'text <a href="http://test_url.test">http://test_url.test</a>"onmouseover="alert(1)"onerror=1 "text',
 			) as $lText => $lExpected )
 		{
 			$this->assertEqual( make_clickable($lText), $lExpected );
 		}
 	}
diff --git a/inc/_core/_misc.funcs.php b/inc/_core/_misc.funcs.php
index c487df914..0f716268c 100644
--- a/inc/_core/_misc.funcs.php
+++ b/inc/_core/_misc.funcs.php
@@ -1319,15 +1319,15 @@ function make_clickable_callback( $text, $moredelim = '&amp;', $additional_attrs
 	$pattern_domain = '([\p{L}0-9\-]+\.[\p{L}0-9\-.\~]+)'; // a domain name (not very strict)
 	$text = preg_replace(
 		/* Tblue> I removed the double quotes from the first RegExp because
 				  it made URLs in tag attributes clickable.
 				  See http://forums.b2evolution.net/viewtopic.php?p=92073 */
-		array( '#(^|[\s>\(]|\[url=)(https?|mailto)://([^<>{}\s]+[^.,:;!\?<>{}\s\]\)])#i',
-			'#(^|[\s>\(]|\[url=)aim:([^,<\s\]\)]+)#i',
+		array( '#(^|[\s>\(]|\[url=)(https?|mailto)://([^"<>{}\s]+[^".,:;!\?<>{}\s\]\)])#i',
+			'#(^|[\s>\(]|\[url=)aim:([^",<\s\]\)]+)#i',
 			'#(^|[\s>\(]|\[url=)icq:(\d+)#i',
-			'#(^|[\s>\(]|\[url=)www\.'.$pattern_domain.'([^<>{}\s]*[^.,:;!\?\s\]\)])#i',
-			'#(^|[\s>\(]|\[url=)([a-z0-9\-_.]+?)@'.$pattern_domain.'([^.,:;!\?<\s\]\)]+)#i', ),
+			'#(^|[\s>\(]|\[url=)www\.'.$pattern_domain.'([^"<>{}\s]*[^".,:;!\?\s\]\)])#i',
+			'#(^|[\s>\(]|\[url=)([a-z0-9\-_.]+?)@'.$pattern_domain.'([^".,:;!\?<\s\]\)]+)#i', ),
 		array( '$1<a href="$2://$3"'.$additional_attrs.'>$2://$3</a>',
 			'$1<a href="aim:goim?screenname=$2$3'.$moredelim.'message='.rawurlencode(T_('Hello')).'"'.$additional_attrs.'>$2$3</a>',
 			'$1<a href="http://wwp.icq.com/scripts/search.dll?to=$2"'.$additional_attrs.'>$2</a>',
 			'$1<a href="http://www.$2$3$4"'.$additional_attrs.'>www.$2$3$4</a>',
 			'$1<a href="mailto:$2@$3$4"'.$additional_attrs.'>$2@$3$4</a>', ),

Vulnerable code: 		array( '#(^|[\s>\(]|\[url=)(https?|mailto)://([^<>{}\s]+[^.,:;!\?<>{}\s\]\)])#i',
			'#(^|[\s>\(]|\[url=)aim:([^,<\s\]\)]+)#i',
			'#(^|[\s>\(]|\[url=)www\.'.$pattern_domain.'([^<>{}\s]*[^.,:;!\?\s\]\)])#i',
			'#(^|[\s>\(]|\[url=)([a-z0-9\-_.]+?)@'.$pattern_domain.'([^.,:;!\?<\s\]\)]+)#i', ),
Fixed code: 
				// XSS sample:
				'text http://test_url.test"onmouseover="alert(1)"onerror=1 "text' => 'text <a href="http://test_url.test">http://test_url.test</a>"onmouseover="alert(1)"onerror=1 "text',
		array( '#(^|[\s>\(]|\[url=)(https?|mailto)://([^"<>{}\s]+[^".,:;!\?<>{}\s\]\)])#i',
			'#(^|[\s>\(]|\[url=)aim:([^",<\s\]\)]+)#i',
			'#(^|[\s>\(]|\[url=)www\.'.$pattern_domain.'([^"<>{}\s]*[^".,:;!\?\s\]\)])#i',
			'#(^|[\s>\(]|\[url=)([a-z0-9\-_.]+?)@'.$pattern_domain.'([^".,:;!\?<\s\]\)]+)#i', ),