libre-service.eu/paste.libre-service.eu-privatebin
libre-service.eu/paste.libre-service.eu-privatebin
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

reverting Helper.urls2links() method to old style, applied to element instead of string, allows inserting plain text as text node

Browse source
This commit is contained in:
El RIDO 2020-03-06 22:18:38 +01:00
parent 8a6dcf910a
commit c11dc8e17e
No known key found for this signature in database
GPG key ID: 0F5C940A6BD81F92
4 changed files with 51 additions and 44 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
js/privatebin.js
View file

@ -281,7 +281,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
}; };
/** /**
* convert URLs to clickable links. * convert URLs to clickable links in the provided element.
* *
* URLs to handle: * URLs to handle:
* <pre> * <pre>
@ -292,14 +292,15 @@ jQuery.PrivateBin = (function($, RawDeflate) {
* *
* @name Helper.urls2links * @name Helper.urls2links
* @function * @function
* @param {string} html * @param {HTMLElement} element
* @return {string}
*/ */
me.urls2links = function(html) me.urls2links = function(element)
{ {
return html.replace( element.html(
/(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]*>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig, element.html().replace(
'<a href="$1" rel="nofollow">$1</a>' /(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]*>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig,
'<a href="$1" rel="nofollow">$1</a>'
)
); );
}; };
@ -2439,11 +2440,6 @@ jQuery.PrivateBin = (function($, RawDeflate) {
// add table classes from bootstrap css // add table classes from bootstrap css
$plainText.find('table').addClass('table-condensed table-bordered'); $plainText.find('table').addClass('table-condensed table-bordered');
} else { } else {
// escape HTML entities, link URLs, sanitize
const escapedLinkedText = Helper.urls2links(text);
let sanitizeLinkedText = '',
sanitizerConfiguration = {};
if (format === 'syntaxhighlighting') { if (format === 'syntaxhighlighting') {
// yes, this is really needed to initialize the environment // yes, this is really needed to initialize the environment
if (typeof prettyPrint === 'function') if (typeof prettyPrint === 'function')
@ -2451,22 +2447,16 @@ jQuery.PrivateBin = (function($, RawDeflate) {
prettyPrint(); prettyPrint();
} }
sanitizeLinkedText = prettyPrintOne( $prettyPrint.html(
escapedLinkedText, null, true prettyPrintOne(
Helper.htmlEntities(text), null, true
)
); );
} else { } else {
// = 'plaintext' // = 'plaintext'
sanitizeLinkedText = escapedLinkedText; $prettyPrint.text(text);
sanitizerConfiguration = {
ALLOWED_TAGS: ['a'],
ALLOWED_ATTR: ['href', 'rel']
};
} }
$prettyPrint.html( Helper.urls2links($prettyPrint);
DOMPurify.sanitize(
sanitizeLinkedText, sanitizerConfiguration
)
);
$prettyPrint.css('white-space', 'pre-wrap'); $prettyPrint.css('white-space', 'pre-wrap');
$prettyPrint.css('word-break', 'normal'); $prettyPrint.css('word-break', 'normal');
$prettyPrint.removeClass('prettyprint'); $prettyPrint.removeClass('prettyprint');
@ -3243,14 +3233,8 @@ jQuery.PrivateBin = (function($, RawDeflate) {
const $commentEntryData = $commentEntry.find('div.commentdata'); const $commentEntryData = $commentEntry.find('div.commentdata');
// set & parse text // set & parse text
$commentEntryData.html( $commentEntryData.text(commentText);
DOMPurify.sanitize( Helper.urls2links($commentEntryData);
Helper.urls2links(commentText), {
ALLOWED_TAGS: ['a'],
ALLOWED_ATTR: ['href', 'rel']
}
)
);
// set nickname // set nickname
if (nickname.length > 0) { if (nickname.length > 0) {

43
js/test/Helper.js
View file

@ -81,7 +81,15 @@ describe('Helper', function () {
'ignores non-URL content', 'ignores non-URL content',
'string', 'string',
function (content) { function (content) {
return content === $.PrivateBin.Helper.urls2links(content); content = content.replace("\r", "\n").replace("\u0000", '');
let clean = jsdom();
$('body').html('<div id="foo"></div>');
let e = $('#foo');
e.text(content);
$.PrivateBin.Helper.urls2links(e);
let result = e.text();
clean();
return content === result;
} }
); );
jsc.property( jsc.property(
@ -95,9 +103,12 @@ describe('Helper', function () {
function (prefix, schema, address, query, fragment, postfix) { function (prefix, schema, address, query, fragment, postfix) {
query = query.join(''); query = query.join('');
fragment = fragment.join(''); fragment = fragment.join('');
prefix = $.PrivateBin.Helper.htmlEntities(prefix); prefix = prefix.replace("\r", "\n").replace("\u0000", '');
postfix = ' ' + $.PrivateBin.Helper.htmlEntities(postfix); postfix = ' ' + postfix.replace("\r", "\n").replace("\u0000", '');
let url = schema + '://' + address.join('') + '/?' + query + '#' + fragment; let url = schema + '://' + address.join('') + '/?' + query + '#' + fragment,
clean = jsdom();
$('body').html('<div id="foo"></div>');
let e = $('#foo');
// special cases: When the query string and fragment imply the beginning of an HTML entity, eg. &#0 or &#x // special cases: When the query string and fragment imply the beginning of an HTML entity, eg. &#0 or &#x
if ( if (
@ -108,8 +119,12 @@ describe('Helper', function () {
url = schema + '://' + address.join('') + '/?' + query.substring(0, query.length - 1); url = schema + '://' + address.join('') + '/?' + query.substring(0, query.length - 1);
postfix = ''; postfix = '';
} }
e.text(prefix + url + postfix);
return prefix + '<a href="' + url + '" rel="nofollow">' + url + '</a>' + postfix === $.PrivateBin.Helper.urls2links(prefix + url + postfix); $.PrivateBin.Helper.urls2links(e);
let result = e.html();
clean();
url = $('<div />').text(url).html();
return $('<div />').text(prefix).html() + '<a href="' + url + '" rel="nofollow">' + url + '</a>' + $('<div />').text(postfix).html() === result;
} }
); );
jsc.property( jsc.property(
@ -118,10 +133,18 @@ describe('Helper', function () {
jsc.array(common.jscQueryString()), jsc.array(common.jscQueryString()),
'string', 'string',
function (prefix, query, postfix) { function (prefix, query, postfix) {
prefix = $.PrivateBin.Helper.htmlEntities(prefix); prefix = prefix.replace("\r", "\n").replace("\u0000", '');
postfix = $.PrivateBin.Helper.htmlEntities(postfix); postfix = ' ' + postfix.replace("\r", "\n").replace("\u0000", '');
let url = 'magnet:?' + query.join('').replace(/^&+|&+$/gm,''); let url = 'magnet:?' + query.join('').replace(/^&+|&+$/gm,''),
return prefix + '<a href="' + url + '" rel="nofollow">' + url + '</a> ' + postfix === $.PrivateBin.Helper.urls2links(prefix + url + ' ' + postfix); clean = jsdom();
$('body').html('<div id="foo"></div>');
let e = $('#foo');
e.text(prefix + url + postfix);
$.PrivateBin.Helper.urls2links(e);
let result = e.html();
clean();
url = $('<div />').text(url).html();
return $('<div />').text(prefix).html() + '<a href="' + url + '" rel="nofollow">' + url + '</a>' + $('<div />').text(postfix).html() === result;
} }
); );
}); });

2
tpl/bootstrap.php
View file

@ -72,7 +72,7 @@ endif;
?> ?>
<script type="text/javascript" data-cfasync="false" src="js/purify-2.0.8.js" integrity="sha512-QwcEKGuEmKtMguCO9pqNtUtZqq9b/tJ8gNr5qhY8hykq3zKTlDOvpZAmf6Rs8yH35Bz1ZdctUjj2qEWxT5aXCg==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/purify-2.0.8.js" integrity="sha512-QwcEKGuEmKtMguCO9pqNtUtZqq9b/tJ8gNr5qhY8hykq3zKTlDOvpZAmf6Rs8yH35Bz1ZdctUjj2qEWxT5aXCg==" crossorigin="anonymous"></script>
<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-YrCefSac8MOPuEvP3IJTSt6svl0P34qwnFy6czhtOJ6yN6ykmmrFdXKWMmD/gyp+hBnFdQnkC7o3GtrjuZkZgA==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-JDQ0DFju78H5r/ZGC1n54tXnkhfijFRXxOvyWPZUTKlWKF2b1GVoPaS3eckgNcpb3MGvcYiMlhcg3xZNeyWtLQ==" crossorigin="anonymous"></script>
<link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" /> <link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" />
<link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" /> <link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" />
<link rel="icon" type="image/png" href="img/favicon-16x16.png?<?php echo rawurlencode($VERSION); ?>" sizes="16x16" /> <link rel="icon" type="image/png" href="img/favicon-16x16.png?<?php echo rawurlencode($VERSION); ?>" sizes="16x16" />

2
tpl/page.php
View file

@ -50,7 +50,7 @@ endif;
?> ?>
<script type="text/javascript" data-cfasync="false" src="js/purify-2.0.8.js" integrity="sha512-QwcEKGuEmKtMguCO9pqNtUtZqq9b/tJ8gNr5qhY8hykq3zKTlDOvpZAmf6Rs8yH35Bz1ZdctUjj2qEWxT5aXCg==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/purify-2.0.8.js" integrity="sha512-QwcEKGuEmKtMguCO9pqNtUtZqq9b/tJ8gNr5qhY8hykq3zKTlDOvpZAmf6Rs8yH35Bz1ZdctUjj2qEWxT5aXCg==" crossorigin="anonymous"></script>
<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-YrCefSac8MOPuEvP3IJTSt6svl0P34qwnFy6czhtOJ6yN6ykmmrFdXKWMmD/gyp+hBnFdQnkC7o3GtrjuZkZgA==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-JDQ0DFju78H5r/ZGC1n54tXnkhfijFRXxOvyWPZUTKlWKF2b1GVoPaS3eckgNcpb3MGvcYiMlhcg3xZNeyWtLQ==" crossorigin="anonymous"></script>
<link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" /> <link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" />
<link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" /> <link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" />
<link rel="icon" type="image/png" href="img/favicon-16x16.png?<?php echo rawurlencode($VERSION); ?>" sizes="16x16" /> <link rel="icon" type="image/png" href="img/favicon-16x16.png?<?php echo rawurlencode($VERSION); ?>" sizes="16x16" />