From 3de722d3df9ef3945dd78a9121a18e7f24f707a7 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 27 Apr 2026 06:41:56 +0000
Subject: [PATCH] =?UTF-8?q?[security]KVE-2026-0787=20alert()=20JavaScript?=
 =?UTF-8?q?=20=EC=9D=B4=EC=8A=A4=EC=BC=80=EC=9D=B4=ED=94=84=20=EB=88=84?=
 =?UTF-8?q?=EB=9D=BD=20Stored=20XSS=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bbs/alert.php, bbs/alert_close.php 가 alert("$msg") 형태로 메시지를
JS 문자열 컨텍스트에 직접 삽입하던 부분을 수정. lib/common.lib.php 에
PHP 5.2 호환 폴백을 갖춘 get_js_safe_string() 헬퍼를 추가하고,
호출부에는 function_exists 가드를 걸어 부분 패치 환경에서도 안전하게
폴백되도록 함.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 bbs/alert.php       |  2 +-
 bbs/alert_close.php |  2 +-
 lib/common.lib.php  | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/bbs/alert.php b/bbs/alert.php
index 26c3700a5..2d060ca12 100644
--- a/bbs/alert.php
+++ b/bbs/alert.php
@@ -48,7 +48,7 @@ if($error) {
 ?>
 
 <script>
-alert("<?php echo $msg; ?>");
+alert(<?php echo function_exists('get_js_safe_string') ? get_js_safe_string($msg) : '""'; ?>);
 <?php if ($url) { ?>
 document.location.replace("<?php echo str_replace('&amp;', '&', $url); ?>");
 <?php } else { ?>
diff --git a/bbs/alert_close.php b/bbs/alert_close.php
index 2d7696a3c..2d9f2e124 100644
--- a/bbs/alert_close.php
+++ b/bbs/alert_close.php
@@ -16,7 +16,7 @@ if($error) {
 ?>
 
 <script>
-alert("<?php echo $msg; ?>");
+alert(<?php echo function_exists('get_js_safe_string') ? get_js_safe_string($msg) : '""'; ?>);
 try {
     window.close();
 } catch(error) {
diff --git a/lib/common.lib.php b/lib/common.lib.php
index 90aa5f313..ad7dfb7fb 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -179,6 +179,40 @@ function get_cookie($cookie_name)
 }
 
 
+// JavaScript 문자열 컨텍스트에 삽입할 값을 안전하게 이스케이프하여 따옴표를 포함한 JS 리터럴로 반환
+// PHP 5.3+ 에서는 json_encode 의 JSON_HEX_* 플래그를 사용하고, 5.2 환경에서는 직접 치환으로 폴백
+if (!function_exists('get_js_safe_string')) {
+    function get_js_safe_string($s)
+    {
+        $s = (string)$s;
+        if (defined('JSON_HEX_TAG')) {
+            $flags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT;
+            if (defined('JSON_UNESCAPED_UNICODE')) {
+                $flags |= JSON_UNESCAPED_UNICODE;
+            }
+            $encoded = @json_encode($s, $flags);
+            if ($encoded !== false && $encoded !== null) {
+                return $encoded;
+            }
+        }
+        return '"' . strtr($s, array(
+            '\\' => '\\\\',
+            '"'  => '\\"',
+            "'"  => '\\u0027',
+            '/'  => '\\/',
+            "\r" => '\\r',
+            "\n" => '\\n',
+            "\t" => '\\t',
+            '<'  => '\\u003C',
+            '>'  => '\\u003E',
+            '&'  => '\\u0026',
+            "\xE2\x80\xA8" => '\\u2028',
+            "\xE2\x80\xA9" => '\\u2029',
+        )) . '"';
+    }
+}
+
+
 // 경고메세지를 경고창으로
 function alert($msg='', $url='', $error=true, $post=false)
 {