Security changes from upstream 1.7.5-p5

app/code/Magento/PageBuilder/Model/Validator/IframeSrcAttributeValidator.php

@@ -1,7 +1,7 @@
 <?php
 /**
- * Copyright © Magento, Inc. All rights reserved.
- * See COPYING.txt for license details.
+ * Copyright 2020 Adobe
+ * All Rights Reserved.
  */
 
 declare(strict_types=1);
@@ -16,10 +16,15 @@
  */
 class IframeSrcAttributeValidator implements AttributeValidatorInterface
 {
+    /**
+     * @var array
+     */
+    private array $allowedHostsMap;
+
     /**
      * @var string[]
      */
-    private $allowedHosts;
+    private array $allowedHosts;
 
     /**
      * IframeSrcAttributeValidator constructor.
@@ -28,33 +33,33 @@ class IframeSrcAttributeValidator implements AttributeValidatorInterface
      */
     public function __construct(array $allowedHosts)
     {
-        $this->allowedHosts = $allowedHosts;
+        $normalized = array_map('strtolower', $allowedHosts);
+        $this->allowedHosts = $normalized;
+        $this->allowedHostsMap = array_fill_keys($normalized, true);
     }
 
     /**
      * @inheritDoc
      */
     public function validate(string $tag, string $attributeName, string $value): void
     {
-        if ($tag !== 'iframe' || $attributeName !== 'src') {
+        if ($tag !== 'iframe' || $attributeName !== 'src' || !$this->allowedHosts) {
             return;
         }
 
-        if (mb_strpos($value, 'http') !== 0) {
-            //Relative link
-            return;
-        }
         // phpcs:ignore Magento2.Functions.DiscouragedFunction
         $srcHost = parse_url($value, PHP_URL_HOST);
-        if (!$srcHost || !$this->allowedHosts) {
-            //Either the link is invalid or we do not have the allowed list.
+        if (!$srcHost) {
+            throw new ValidationException(__('Invalid IFRAME source provided'));
+        }
+
+        $srcHost = strtolower($srcHost);
+        if (isset($this->allowedHostsMap[$srcHost])) {
             return;
         }
-        $srcHostLength = mb_strlen($srcHost);
+
         foreach ($this->allowedHosts as $host) {
-            $hostLength = mb_strlen($host);
-            $foundIndex = mb_strpos($srcHost, $host);
-            if ($foundIndex !== false && ($foundIndex + $hostLength) === $srcHostLength) {
+            if (str_ends_with($srcHost, '.' . $host)) {
                 return;
             }
         }

app/code/Magento/PageBuilder/i18n/en_US.csv

@@ -323,3 +323,4 @@ OK,OK
 "Save Content as Template","Save Content as Template"
 "Template Name","Template Name"
 "Could not delete the Template: %1","Could not delete the Template: %1"
+"Invalid IFRAME source provided","Invalid IFRAME source provided"