From 2cbb8bf3ca470804c4a8d0636a4358db66a9abdf Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sun, 2 Feb 2020 07:08:38 +0100 Subject: [PATCH] in translation, allow links to be inserted unencoded into href attribute, simplfy sanitation by allowing only tags in DOMpurify for plain text and comments and avoid DOMpurify removing magnet links, fixes #579 --- js/privatebin.js | 47 ++++++++++++++++++++++++++++------------------- js/test/Helper.js | 16 ++++++++-------- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 4 files changed, 38 insertions(+), 29 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index 21676bf..73fa1a0 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -198,7 +198,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { * @enum {Object} * @readonly */ - var entityMap = { + const entityMap = { '&': '&', '<': '<', '>': '>', @@ -422,17 +422,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { ); } - /** - * resets state, used for unit testing - * - * @name Helper.reset - * @function - */ - me.reset = function() - { - baseUri = null; - }; - /** * calculate expiration date given initial date and expiration period * @@ -472,6 +461,17 @@ jQuery.PrivateBin = (function($, RawDeflate) { return expirationDate; }; + /** + * resets state, used for unit testing + * + * @name Helper.reset + * @function + */ + me.reset = function() + { + baseUri = null; + }; + return me; })(); @@ -633,7 +633,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { if (containsLinks || $element === null) { for (let i = 0; i < args.length; ++i) { // parameters (i > 0) may never contain HTML as they may come from untrusted parties - if (i > 0 || !containsLinks) { + if ((containsLinks ? i > 1 : i > 0) || !containsLinks) { args[i] = Helper.htmlEntities(args[i]); } } @@ -2423,10 +2423,13 @@ jQuery.PrivateBin = (function($, RawDeflate) { } // escape HTML entities, link URLs, sanitize - const escapedLinkedText = Helper.urls2links( - Helper.htmlEntities(text).split('/').join('/') - ), - sanitizedLinkedText = DOMPurify.sanitize(escapedLinkedText); + const escapedLinkedText = Helper.urls2links(text), + sanitizedLinkedText = DOMPurify.sanitize( + escapedLinkedText, { + ALLOWED_TAGS: ['a'], + ALLOWED_ATTR: ['href', 'rel'] + } + ); $plainText.html(sanitizedLinkedText); $prettyPrint.html(sanitizedLinkedText); @@ -3240,7 +3243,10 @@ jQuery.PrivateBin = (function($, RawDeflate) { // set & parse text $commentEntryData.html( DOMPurify.sanitize( - Helper.urls2links(commentText) + Helper.urls2links(commentText), { + ALLOWED_TAGS: ['a'], + ALLOWED_ATTR: ['href', 'rel'] + } ) ); @@ -5217,7 +5223,10 @@ jQuery.PrivateBin = (function($, RawDeflate) { // first load translations I18n.loadTranslations(); - DOMPurify.setConfig({SAFE_FOR_JQUERY: true}); + DOMPurify.setConfig({ + ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|magnet):)/i, + SAFE_FOR_JQUERY: true + }); // center all modals $('.modal').on('show.bs.modal', function(e) { diff --git a/js/test/Helper.js b/js/test/Helper.js index 4399089..dd38e3c 100644 --- a/js/test/Helper.js +++ b/js/test/Helper.js @@ -93,11 +93,11 @@ describe('Helper', function () { jsc.array(common.jscHashString()), 'string', function (prefix, schema, address, query, fragment, postfix) { - var query = query.join(''), - fragment = fragment.join(''), - url = schema + '://' + address.join('') + '/?' + query + '#' + fragment, - prefix = $.PrivateBin.Helper.htmlEntities(prefix), - postfix = ' ' + $.PrivateBin.Helper.htmlEntities(postfix); + query = query.join(''); + fragment = fragment.join(''); + prefix = $.PrivateBin.Helper.htmlEntities(prefix); + postfix = ' ' + $.PrivateBin.Helper.htmlEntities(postfix); + let url = schema + '://' + address.join('') + '/?' + query + '#' + fragment; // special cases: When the query string and fragment imply the beginning of an HTML entity, eg. � or &#x if ( @@ -118,9 +118,9 @@ describe('Helper', function () { jsc.array(common.jscQueryString()), 'string', function (prefix, query, postfix) { - var url = 'magnet:?' + query.join('').replace(/^&+|&+$/gm,''), - prefix = $.PrivateBin.Helper.htmlEntities(prefix), - postfix = $.PrivateBin.Helper.htmlEntities(postfix); + prefix = $.PrivateBin.Helper.htmlEntities(prefix); + postfix = $.PrivateBin.Helper.htmlEntities(postfix); + let url = 'magnet:?' + query.join('').replace(/^&+|&+$/gm,''); return prefix + '' + url + ' ' + postfix === $.PrivateBin.Helper.urls2links(prefix + url + ' ' + postfix); } ); diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index c777171..39a3364 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -72,7 +72,7 @@ endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index 126c2a5..3ad0b6e 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -50,7 +50,7 @@ endif; ?> - +