discourse/app/assets/javascripts/pretty-text/sanitizer.js.es6

154 lines
3.9 KiB
Plaintext
Raw Normal View History

2018-06-15 11:03:24 -04:00
import xss from "pretty-text/xss";
function attr(name, value) {
2016-07-20 13:30:36 -04:00
if (value) {
return `${name}="${xss.escapeAttrValue(value)}"`;
}
return name;
}
const ESCAPE_REPLACEMENTS = {
"&": "&",
"<": "&lt;",
">": "&gt;",
'"': "&quot;",
"'": "&#x27;",
2018-06-15 11:03:24 -04:00
"`": "&#x60;"
};
const BAD_CHARS = /[&<>"'`]/g;
const POSSIBLE_CHARS = /[&<>"'`]/;
function escapeChar(chr) {
return ESCAPE_REPLACEMENTS[chr];
}
export function escape(string) {
// don't escape SafeStrings, since they're already safe
if (string === null) {
return "";
} else if (!string) {
2018-06-15 11:03:24 -04:00
return string + "";
}
// Force a string conversion as this will be done by the append regardless and
// the regex test will do this transparently behind the scenes, causing issues if
// an object's to string has escaped characters in it.
string = "" + string;
2018-06-15 11:03:24 -04:00
if (!POSSIBLE_CHARS.test(string)) {
return string;
}
return string.replace(BAD_CHARS, escapeChar);
}
export function hrefAllowed(href, extraHrefMatchers) {
// escape single quotes
href = href.replace(/'/g, "%27");
// absolute urls
2018-06-15 11:03:24 -04:00
if (/^(https?:)?\/\/[\w\.\-]+/i.test(href)) {
return href;
}
// relative urls
2018-06-15 11:03:24 -04:00
if (/^\/[\w\.\-]+/i.test(href)) {
return href;
}
// anchors
2018-06-15 11:03:24 -04:00
if (/^#[\w\.\-]+/i.test(href)) {
return href;
}
// mailtos
2018-06-15 11:03:24 -04:00
if (/^mailto:[\w\.\-@]+/i.test(href)) {
return href;
}
if (extraHrefMatchers && extraHrefMatchers.length > 0) {
2018-06-15 11:03:24 -04:00
for (let i = 0; i < extraHrefMatchers.length; i++) {
if (extraHrefMatchers[i].test(href)) {
return href;
}
}
}
}
export function sanitize(text, whiteLister) {
if (!text) return "";
// Allow things like <3 and <_<
text = text.replace(/<([^A-Za-z\/\!]|$)/g, "&lt;$1");
const whiteList = whiteLister.getWhiteList(),
2018-06-15 11:03:24 -04:00
allowedHrefSchemes = whiteLister.getAllowedHrefSchemes(),
allowedIframes = whiteLister.getAllowedIframes();
let extraHrefMatchers = null;
if (allowedHrefSchemes && allowedHrefSchemes.length > 0) {
2018-06-15 11:03:24 -04:00
extraHrefMatchers = [
new RegExp("^(" + allowedHrefSchemes.join("|") + ")://[\\w\\.\\-]+", "i")
];
if (allowedHrefSchemes.includes("tel")) {
extraHrefMatchers.push(new RegExp("^tel://\\+?[\\w\\.\\-]+", "i"));
}
}
let result = xss(text, {
whiteList: whiteList.tagList,
stripIgnoreTag: true,
2018-06-15 11:03:24 -04:00
stripIgnoreTagBody: ["script", "table"],
2016-07-04 14:15:51 -04:00
onIgnoreTagAttr(tag, name, value) {
const forTag = whiteList.attrList[tag];
if (forTag) {
const forAttr = forTag[name];
if (
2018-06-15 11:03:24 -04:00
(forAttr &&
(forAttr.indexOf("*") !== -1 || forAttr.indexOf(value) !== -1)) ||
(name.indexOf("data-") === 0 && forTag["data-*"]) ||
(tag === "a" &&
name === "href" &&
hrefAllowed(value, extraHrefMatchers)) ||
(tag === "img" &&
name === "src" &&
(/^data:image.*$/i.test(value) ||
hrefAllowed(value, extraHrefMatchers))) ||
(tag === "iframe" &&
name === "src" &&
allowedIframes.some(i => {
return value.toLowerCase().indexOf((i || "").toLowerCase()) === 0;
}))
) {
return attr(name, value);
}
2018-06-15 11:03:24 -04:00
if (tag === "iframe" && name === "src") {
return "-STRIP-";
}
// Heading ids must begin with `heading--`
if (
2018-06-15 11:03:24 -04:00
["h1", "h2", "h3", "h4", "h5", "h6"].indexOf(tag) !== -1 &&
value.match(/^heading\-\-[a-zA-Z0-9\-\_]+$/)
) {
return attr(name, value);
}
const custom = whiteLister.getCustom();
2018-06-15 11:03:24 -04:00
for (let i = 0; i < custom.length; i++) {
const fn = custom[i];
if (fn(tag, name, value)) {
return attr(name, value);
}
}
}
2018-06-15 11:03:24 -04:00
}
});
2018-06-15 11:03:24 -04:00
return result
.replace(/\[removed\]/g, "")
.replace(/\<iframe[^>]+\-STRIP\-[^>]*>[^<]*<\/iframe>/g, "")
.replace(/&(?![#\w]+;)/g, "&amp;")
.replace(/&#39;/g, "'")
.replace(/ \/>/g, ">");
}