Hi

Our research team in KAIST WSP Lab found a known XSS vulnerability in the recent version of docker-training.
In particular, the bug we report is a known bug by CVE-2019-20041.

wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.

Please check this line:

Thanks!

git clone之后,在mariadb build之前,mariadb Dockerfile的目录下执行以下命令,否则启动mariadb时执行脚本无权限,失败

chmod +x -R scripts/

docker build -t csphere/php-fpm:5.4 .
在执行这条命令时,失败,上网查了一下是centos7.1的bug,在Dockerfile中所有的RUN之前添加一行后成功
RUN yum clean all && yum swap fakesystemd systemd -y

MAINTAINER Carson,C.J.Zeong [email protected]

DOCKER-VERSION 1.6.2

Dockerizing php-fpm: Dockerfile for building php-fpm images

FROM csphere/centos:7.1
MAINTAINER Carson,C.J.Zeong [email protected]

Set environment variable

ENV APP_DIR /app

RUN yum clean all && yum swap fakesystemd systemd -y
RUN yum -y install nginx php-cli php-mysql php-pear php-ldap php-mbstring php-soap php-
yum clean all

ADD nginx_nginx.conf /etc/nginx/nginx.conf
ADD nginx_default.conf /etc/nginx/conf.d/default.conf

ADD php_www.conf /etc/php-fpm.d/www.conf
RUN sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/' /etc/php.ini

RUN mkdir -p /app && echo "" > ${APP_DIR}/info.php

EXPOSE 80 443

ADD supervisor_nginx.conf /etc/supervisor.conf.d/nginx.conf
ADD supervisor_php-fpm.conf /etc/supervisor.conf.d/php-fpm.conf

ONBUILD ADD . /app
ONBUILD RUN chown -R nginx:nginx /app