Fixed entity sanitization for XSS detection

getgrav · Feb 23, 2022 · 3dd0cab · 3dd0cab · Shadw666 · Mar 1, 2022
1 parent b992d7f
commit 3dd0cab
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,7 @@
     * Fixed `'mbstring' extension is not loaded` error, use Polyfill instead [#3504](https://github.com/getgrav/grav/pull/3504)
     * Fixed new `Utils::pathinfo()` and `Utils::basename()` being too strict for legacy use [#3542](https://github.com/getgrav/grav/issues/3542)
     * Fixed non-standard video html atributes generated by `{{ media.html() }}` [#3540](https://github.com/getgrav/grav/issues/3540)
+    * Fixed entity sanitization for XSS detection
 
 # v1.7.30
 ## 02/07/2022

diff --git a/system/src/Grav/Common/Security.php b/system/src/Grav/Common/Security.php
@@ -200,7 +200,7 @@ public static function detectXss($string, array $options = null): ?string
         }, $string);
 
         // Clean up entities
-        $string = preg_replace('!(&#0+[0-9]+)!u', '$1;', $string);
+        $string = preg_replace('!(&#[0-9]+)!u', '$1;', $string);
 
         // Decode entities
         $string = html_entity_decode($string, ENT_NOQUOTES | ENT_HTML5, 'UTF-8');