codeninjasllc/discourse
1
0
Fork 0
mirror of https://github.com/codeninjasllc/discourse.git synced 2024-11-30 10:58:31 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

SECURITY: sanitize markdown urls (prevent XSS)

Browse source
This commit is contained in:
Régis Hanol 2014-03-27 15:34:35 +01:00
parent d5b1b64bb8
commit e663d78104
2 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
app/assets/javascripts/discourse/dialects/anchor_dialect.js Normal file
View file

@ -0,0 +1,13 @@
// prevent XSS
Discourse.Dialect.on('parseNode', function (event) {
var node = event.node;
if (node[0] === 'a') {
var attributes = node[1];
if (attributes["href"]) {
if (!Discourse.Markdown.urlAllowed(attributes["href"])) {
delete attributes["href"];
}
}
}
});

2
test/javascripts/lib/markdown_test.js
View file

@ -352,6 +352,8 @@ test("sanitize", function() {
equal(sanitize("<textarea>hullo</textarea>"), "hullo"); equal(sanitize("<textarea>hullo</textarea>"), "hullo");
equal(sanitize("<button>press me!</button>"), "press me!"); equal(sanitize("<button>press me!</button>"), "press me!");
equal(sanitize("<canvas>draw me!</canvas>"), "draw me!"); equal(sanitize("<canvas>draw me!</canvas>"), "draw me!");
cooked("[the answer](javascript:alert(42))", "<p><a>the answer</a></p>", "it prevents XSS");
}); });
test("URLs in BBCode tags", function() { test("URLs in BBCode tags", function() {