CVE-2016-10893: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-08-20T15:15Z
Repository: https://github.com/aramk/crayon-syntax-highlighter
Language: PHP
Files changed: crayon_settings.class.php, crayon_settings_wp.class.php, crayon_wp.class.php, readme.txt
Commit date: 2013-01-12 16:05:29 +1100
Commit message: Inline tags fix

Diff: diff --git a/crayon_settings.class.php b/crayon_settings.class.php
index c52d2d2..e7db10b 100644
--- a/crayon_settings.class.php
+++ b/crayon_settings.class.php
@@ -87,10 +87,11 @@ class CrayonSettings {
 	const ENQUEUE_THEMES = 'enqueque-themes';
 	const ENQUEUE_FONTS = 'enqueque-fonts';
 	const MAIN_QUERY = 'main-query';
 	const SAFE_ENQUEUE = 'safe-enqueue';
 	const INLINE_TAG = 'inline-tag';
+    const INLINE_TAG_CAPTURE = 'inline-tag-capture';
 	const INLINE_MARGIN = 'inline-margin';
 	const INLINE_WRAP = 'inline-wrap';
 	const BACKQUOTE = 'backquote';
 	const COMMENTS = 'comments';
 	const DECODE = 'decode';
@@ -213,11 +214,12 @@ class CrayonSettings {
 			new CrayonSetting(self::PLAIN_TAG, FALSE),
 			new CrayonSetting(self::ENQUEUE_THEMES, TRUE),
 			new CrayonSetting(self::ENQUEUE_FONTS, TRUE),
 			new CrayonSetting(self::MAIN_QUERY, FALSE),
 			new CrayonSetting(self::SAFE_ENQUEUE, TRUE),
-			new CrayonSetting(self::INLINE_TAG, FALSE),
+			new CrayonSetting(self::INLINE_TAG, TRUE),
+            new CrayonSetting(self::INLINE_TAG_CAPTURE, FALSE),
 			new CrayonSetting(self::INLINE_MARGIN, 5),
 			new CrayonSetting(self::INLINE_WRAP, TRUE),
 			new CrayonSetting(self::BACKQUOTE, TRUE),
 			new CrayonSetting(self::COMMENTS, TRUE),
 			new CrayonSetting(self::DECODE, FALSE),
diff --git a/crayon_settings_wp.class.php b/crayon_settings_wp.class.php
index a8c6a29..3009568 100644
--- a/crayon_settings_wp.class.php
+++ b/crayon_settings_wp.class.php
@@ -1053,16 +1053,18 @@ class Human {
         self::span(crayon__('Blank lines after code:') . ' ');
         self::textbox(array('id' => CrayonSettings::WHITESPACE_AFTER, 'size' => 2, 'break' => TRUE));
     }
 
     public static function tags() {
-        echo '<div class="note" style="width: 350px;">', sprintf(crayon__("Using this markup for Mini Tags and Inline tags is now %sdepreciated%s! Use the %sTag Editor%s instead and convert legacy tags."), '<a href="#" target="_blank">', '</a>', '<a href="#" target="_blank">', '</a>'), '</div>';
-        self::checkbox(array(CrayonSettings::CAPTURE_MINI_TAG, crayon__('Capture Mini Tags like [php][/php] as Crayons.') . self::help_button('http://bit.ly/rRZuzk')));
-        self::checkbox(array(CrayonSettings::INLINE_TAG, crayon__('Capture Inline Tags like {php}{/php} inside sentences.') . self::help_button('http://bit.ly/yFafFL')));
+        self::checkbox(array(CrayonSettings::INLINE_TAG, crayon__('Capture Inline Tags') . self::help_button('http://bit.ly/yFafFL')));
         self::checkbox(array(CrayonSettings::INLINE_WRAP, crayon__('Wrap Inline Tags') . self::help_button('http://bit.ly/yFafFL')));
         self::checkbox(array(CrayonSettings::BACKQUOTE, crayon__('Capture `backquotes` as &lt;code&gt;') . self::help_button('http://bit.ly/yFafFL')));
         self::checkbox(array(CrayonSettings::CAPTURE_PRE, crayon__('Capture &lt;pre&gt; tags as Crayons') . self::help_button('http://bit.ly/rRZuzk')));
+
+        echo '<div class="note" style="width: 350px;">', sprintf(crayon__("Using this markup for Mini Tags and Inline tags is now %sdepreciated%s! Use the %sTag Editor%s instead and convert legacy tags."), '<a href="#" target="_blank">', '</a>', '<a href="#" target="_blank">', '</a>'), '</div>';
+        self::checkbox(array(CrayonSettings::CAPTURE_MINI_TAG, crayon__('Capture Mini Tags like [php][/php] as Crayons.') . self::help_button('http://bit.ly/rRZuzk')));
+        self::checkbox(array(CrayonSettings::INLINE_TAG_CAPTURE, crayon__('Capture Inline Tags like {php}{/php} inside sentences.') . self::help_button('http://bit.ly/yFafFL')));
         self::checkbox(array(CrayonSettings::PLAIN_TAG, crayon__('Enable [plain][/plain] tag.') . self::help_button('http://bit.ly/rRZuzk')));
     }
 
     public static function files() {
         echo '<a name="files"></a>';
diff --git a/crayon_wp.class.php b/crayon_wp.class.php
index 18e1a70..2bc4cbd 100644
--- a/crayon_wp.class.php
+++ b/crayon_wp.class.php
@@ -250,11 +250,13 @@ class CrayonWP {
             $wp_content = preg_replace('#(?<!\$)\[\s*(' . self::$alias_regex . ')\b([^\]]*)/\s*\](?!\$)#msi', '[crayon lang="\1" \2 /]', $wp_content);
         }
 
         // Convert inline {php}{/php} tags to crayon tags, if needed
         if ((CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG) || $skip_setting_check) && $in_flag[CrayonSettings::INLINE_TAG]) {
-            $wp_content = preg_replace('#(?<!\$)\{\s*(' . self::$alias_regex . ')\b([^\}]*)\}(.*?)\{/(?:\1)\}(?!\$)#msi', '[crayon lang="\1" inline="true" \2]\3[/crayon]', $wp_content);
+            if (CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG_CAPTURE)) {
+                $wp_content = preg_replace('#(?<!\$)\{\s*(' . self::$alias_regex . ')\b([^\}]*)\}(.*?)\{/(?:\1)\}(?!\$)#msi', '[crayon lang="\1" inline="true" \2]\3[/crayon]', $wp_content);
+            }
             // Convert <span class="crayon-inline"> tags to inline crayon tags
             $wp_content = preg_replace_callback('#(?<!\$)<\s*span([^>]*)\bclass\s*=\s*(["\'])(.*?)\2([^>]*)>(.*?)<\s*/\s*span\s*>#msi', 'CrayonWP::span_tag', $wp_content);
         }
 
         // Convert [plain] tags into <pre><code></code></pre>, if needed
@@ -515,11 +517,11 @@ class CrayonWP {
         if ($force || $tags_regex === "") {
             // Check which tags are in $flags. If it's NULL, then all flags are true.
             $in_flag = self::in_flag($flags);
 
             if (($in_flag[CrayonSettings::CAPTURE_MINI_TAG] && (CrayonGlobalSettings::val(CrayonSettings::CAPTURE_MINI_TAG)) || $force) ||
-                ($in_flag[CrayonSettings::INLINE_TAG] && (CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG)) || $force)
+                ($in_flag[CrayonSettings::INLINE_TAG] && (CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG) && CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG_CAPTURE)) || $force)
             ) {
                 $aliases = CrayonResources::langs()->ids_and_aliases();
                 self::$alias_regex = '';
                 for ($i = 0; $i < count($aliases); $i++) {
                     $alias = $aliases[$i];
@@ -793,11 +795,11 @@ class CrayonWP {
         }
         if (CrayonGlobalSettings::val(CrayonSettings::PLAIN_TAG)) {
             $the_content = str_ireplace(array($ignore_flag . '[plain', 'plain]' . $ignore_flag), array('[plain', 'plain]'), $the_content);
         }
         if (CrayonGlobalSettings::val(CrayonSettings::CAPTURE_MINI_TAG) ||
-            CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG)
+            (CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG && CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG_CAPTURE)))
         ) {
             self::init_tags_regex();
             // 			$the_content = preg_replace('#'.$ignore_flag_regex.'\s*([\[\{])\s*('. self::$alias_regex .')#', '$1$2', $the_content);
             // 			$the_content = preg_replace('#('. self::$alias_regex .')\s*([\]\}])\s*'.$ignore_flag_regex.'#', '$1$2', $the_content);
             $the_content = preg_replace('#' . $ignore_flag_regex . '(\s*[\[\{]\s*(' . self::$alias_regex . ')[^\]]*[\]\}])#', '$1', $the_content);
diff --git a/readme.txt b/readme.txt
index d500fa0..eb5456a 100644
--- a/readme.txt
+++ b/readme.txt
@@ -269,10 +269,11 @@ Contact me at http://twitter.com/crayonsyntax or crayon.syntax@gmail.com.
 * ADDED:
     * Arduino language
     * Added CoffeeScript thanks to http://firn.jp/crayon-coffeescript
 * FIXED:
     * jQuery UI is no longer an external dependency; now using wpdialog().
+    * Inline tags. See: https://github.com/aramkocharyan/crayon-syntax-highlighter/issues/57
     * Improved legacy tag conversion functions by removing false positives arising from duplicate regex
     * Slightly faster conversion of legacy by delaying database writes until the end
     * &-quot; is also converted now in HTML
     * Added missing blank.gif in fancybox
     * Log uses strval() instead of ob_start() to avoid conflicts with other plugins using ob_start() without ob_end_flush() or similar

Vulnerable code: 			new CrayonSetting(self::INLINE_TAG, FALSE),
        echo '<div class="note" style="width: 350px;">', sprintf(crayon__("Using this markup for Mini Tags and Inline tags is now %sdepreciated%s! Use the %sTag Editor%s instead and convert legacy tags."), '<a href="#" target="_blank">', '</a>', '<a href="#" target="_blank">', '</a>'), '</div>';
        self::checkbox(array(CrayonSettings::CAPTURE_MINI_TAG, crayon__('Capture Mini Tags like [php][/php] as Crayons.') . self::help_button('http://bit.ly/rRZuzk')));
        self::checkbox(array(CrayonSettings::INLINE_TAG, crayon__('Capture Inline Tags like {php}{/php} inside sentences.') . self::help_button('http://bit.ly/yFafFL')));
            $wp_content = preg_replace('#(?<!\$)\{\s*(' . self::$alias_regex . ')\b([^\}]*)\}(.*?)\{/(?:\1)\}(?!\$)#msi', '[crayon lang="\1" inline="true" \2]\3[/crayon]', $wp_content);
                ($in_flag[CrayonSettings::INLINE_TAG] && (CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG)) || $force)
            CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG)
Fixed code:     const INLINE_TAG_CAPTURE = 'inline-tag-capture';
			new CrayonSetting(self::INLINE_TAG, TRUE),
            new CrayonSetting(self::INLINE_TAG_CAPTURE, FALSE),
        self::checkbox(array(CrayonSettings::INLINE_TAG, crayon__('Capture Inline Tags') . self::help_button('http://bit.ly/yFafFL')));

        echo '<div class="note" style="width: 350px;">', sprintf(crayon__("Using this markup for Mini Tags and Inline tags is now %sdepreciated%s! Use the %sTag Editor%s instead and convert legacy tags."), '<a href="#" target="_blank">', '</a>', '<a href="#" target="_blank">', '</a>'), '</div>';
        self::checkbox(array(CrayonSettings::CAPTURE_MINI_TAG, crayon__('Capture Mini Tags like [php][/php] as Crayons.') . self::help_button('http://bit.ly/rRZuzk')));
        self::checkbox(array(CrayonSettings::INLINE_TAG_CAPTURE, crayon__('Capture Inline Tags like {php}{/php} inside sentences.') . self::help_button('http://bit.ly/yFafFL')));
            if (CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG_CAPTURE)) {
                $wp_content = preg_replace('#(?<!\$)\{\s*(' . self::$alias_regex . ')\b([^\}]*)\}(.*?)\{/(?:\1)\}(?!\$)#msi', '[crayon lang="\1" inline="true" \2]\3[/crayon]', $wp_content);
            }
                ($in_flag[CrayonSettings::INLINE_TAG] && (CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG) && CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG_CAPTURE)) || $force)
            (CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG && CrayonGlobalSettings::val(CrayonSettings::INLINE_TAG_CAPTURE)))
    * Inline tags. See: https://github.com/aramkocharyan/crayon-syntax-highlighter/issues/57