[Pmwiki-users] SingleWikiWords implementation (was: Single-Word WikiWords)

[Patrick R. Michaud]

With this implementation of SingleWikiWords that it may be possible for a
wiki author to use this feature to execute arbitrary PHP code on the
server.  For example, someone could create an entry in the SingleWikiWords
page such as

   '/0wn3d/e' => 'system("rm pmwiki.php");'

and the '/e' modifier to the regular expression would cause the
$DoubleBrackets to execute the code on the right side of the => rather
than doing a simple text substitution.  I can come up with much more
malicious examples than the one above.  :-)

This implementation also makes it possible for (malicious) wiki
authors to insert arbitrary HTML code into pages, including JavaScript
and other "spoofing" items.

I haven't tried any of the above, but these would be my concern.

Pm


On Thu, May 06, 2004 at 12:04:32AM +0200, Thomas -Balu- Walter wrote:
> Okay, I've take a few minutes to try to create the wanted
> SingleWikiWords feature. I am testing the code snippet below in my Wiki
> right now:
> 
> Documentation and Code:
> http://www.b-a-l-u.de/index.php/Projects/SingleWikiWords
> 
> SingleWikiWords list:
> http://www.b-a-l-u.de/index.php/Main/SingleWikiWords
> 
> Test area:
> http://www.b-a-l-u.de/index.php/Main/WikiSandbox
> 
> To replace the words I am (mis-)using the DoubleBrackets feature, not
> sure if this might result in any complications... (it is not yet
> Pm-approved ;)
> 
> I am not sure if things should be changed a little. People might wonder
> why their words are replaced with something different. One could put a
> <span title=""> around it (perhaps underlined) and describe that it is
> an inline replacement (including the SingleWikiWords-page) or similar.
> 
> This again would be disabled by the feature I am going to use it for:
> acronym-replacements.
> 
> Any ideas for improvements? Leave it like this? 
> 
> -- Balu
> 
> <?php if (!defined('PmWiki')) exit(); //  vim: set expandtab tabstop=4 shiftwidth=4 softtabstop=4 nowrap:
> /* Copyright 2004 Thomas "Balu" Walter (list+pmwiki-users at b-a-l-u.de)
>    This file is meant to be an extension to PmWiki; you can redistribute it
>    and/or modify it under the terms of the GNU General Public License as
>    published by the Free Software Foundation; either version 2 of the License,
>    or (at your option) any later version.  See pmwiki.php for full details.
> 
>    This script makes it possible to create pages containing words or phrases
>    that are to be replaced with a different string. It is working just as the
>    XLPage internationalization feature of PmWiki (and in fact it is XLpage with
>    very minor changes)
> 
>    To enable this feature you have to save this file as
>        local/singlewikiwords.php 
>    and execute
>        include_once("local/singlewikiwords.php");
>    from config.php somewhere.
> 
>    To specify wich SingleWikiWords page to use you have to call the function
>    SingleWikiWords() just as in the following example:
>        SingleWikiWords('Main/SingleWikiWords');
> 
>    If anyone has suggestions or improvements, please tell me or the PmWiki
>    mailing list.
> */
> 
> // based on XLPage
> function SingleWikiWords($p) {
>   global $DoubleBrackets;
>   $page = ReadPage($p);
>   if (!$page) return;
>   $text = preg_replace("/=>\\s*\n/",'=> ',$page['text']);
>   foreach(explode("\n",$text) as $l)
>     if (preg_match('/^\\s*[\'"](.+?)[\'"]\\s*=>\\s*[\'"](.+)[\'"]/',$l,$match))
>       $xl[stripslashes($match[1])] = stripslashes($match[2]);
>   if (isset($xl)) {
>     SDVA(&$DoubleBrackets,$xl);
>   }
> }
> ?>
> 
> -- 
> Pmwiki-users mailing list
> Pmwiki-users at pmichaud.com
> http://pmichaud.com/mailman/listinfo/pmwiki-users_pmichaud.com