diff --git a/js/privatebin.js b/js/privatebin.js
index 21676bf9..73fa1a0b 100644
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -198,7 +198,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
* @enum {Object}
* @readonly
*/
- var entityMap = {
+ const entityMap = {
'&': '&',
'<': '<',
'>': '>',
@@ -422,17 +422,6 @@ jQuery.PrivateBin = (function($, RawDeflate) {
);
}
- /**
- * resets state, used for unit testing
- *
- * @name Helper.reset
- * @function
- */
- me.reset = function()
- {
- baseUri = null;
- };
-
/**
* calculate expiration date given initial date and expiration period
*
@@ -472,6 +461,17 @@ jQuery.PrivateBin = (function($, RawDeflate) {
return expirationDate;
};
+ /**
+ * resets state, used for unit testing
+ *
+ * @name Helper.reset
+ * @function
+ */
+ me.reset = function()
+ {
+ baseUri = null;
+ };
+
return me;
})();
@@ -633,7 +633,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
if (containsLinks || $element === null) {
for (let i = 0; i < args.length; ++i) {
// parameters (i > 0) may never contain HTML as they may come from untrusted parties
- if (i > 0 || !containsLinks) {
+ if ((containsLinks ? i > 1 : i > 0) || !containsLinks) {
args[i] = Helper.htmlEntities(args[i]);
}
}
@@ -2423,10 +2423,13 @@ jQuery.PrivateBin = (function($, RawDeflate) {
}
// escape HTML entities, link URLs, sanitize
- const escapedLinkedText = Helper.urls2links(
- Helper.htmlEntities(text).split('/').join('/')
- ),
- sanitizedLinkedText = DOMPurify.sanitize(escapedLinkedText);
+ const escapedLinkedText = Helper.urls2links(text),
+ sanitizedLinkedText = DOMPurify.sanitize(
+ escapedLinkedText, {
+ ALLOWED_TAGS: ['a'],
+ ALLOWED_ATTR: ['href', 'rel']
+ }
+ );
$plainText.html(sanitizedLinkedText);
$prettyPrint.html(sanitizedLinkedText);
@@ -3240,7 +3243,10 @@ jQuery.PrivateBin = (function($, RawDeflate) {
// set & parse text
$commentEntryData.html(
DOMPurify.sanitize(
- Helper.urls2links(commentText)
+ Helper.urls2links(commentText), {
+ ALLOWED_TAGS: ['a'],
+ ALLOWED_ATTR: ['href', 'rel']
+ }
)
);
@@ -5217,7 +5223,10 @@ jQuery.PrivateBin = (function($, RawDeflate) {
// first load translations
I18n.loadTranslations();
- DOMPurify.setConfig({SAFE_FOR_JQUERY: true});
+ DOMPurify.setConfig({
+ ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|magnet):)/i,
+ SAFE_FOR_JQUERY: true
+ });
// center all modals
$('.modal').on('show.bs.modal', function(e) {
diff --git a/js/test/Helper.js b/js/test/Helper.js
index 43990893..dd38e3c4 100644
--- a/js/test/Helper.js
+++ b/js/test/Helper.js
@@ -93,11 +93,11 @@ describe('Helper', function () {
jsc.array(common.jscHashString()),
'string',
function (prefix, schema, address, query, fragment, postfix) {
- var query = query.join(''),
- fragment = fragment.join(''),
- url = schema + '://' + address.join('') + '/?' + query + '#' + fragment,
- prefix = $.PrivateBin.Helper.htmlEntities(prefix),
- postfix = ' ' + $.PrivateBin.Helper.htmlEntities(postfix);
+ query = query.join('');
+ fragment = fragment.join('');
+ prefix = $.PrivateBin.Helper.htmlEntities(prefix);
+ postfix = ' ' + $.PrivateBin.Helper.htmlEntities(postfix);
+ let url = schema + '://' + address.join('') + '/?' + query + '#' + fragment;
// special cases: When the query string and fragment imply the beginning of an HTML entity, eg. � or &#x
if (
@@ -118,9 +118,9 @@ describe('Helper', function () {
jsc.array(common.jscQueryString()),
'string',
function (prefix, query, postfix) {
- var url = 'magnet:?' + query.join('').replace(/^&+|&+$/gm,''),
- prefix = $.PrivateBin.Helper.htmlEntities(prefix),
- postfix = $.PrivateBin.Helper.htmlEntities(postfix);
+ prefix = $.PrivateBin.Helper.htmlEntities(prefix);
+ postfix = $.PrivateBin.Helper.htmlEntities(postfix);
+ let url = 'magnet:?' + query.join('').replace(/^&+|&+$/gm,'');
return prefix + '' + url + ' ' + postfix === $.PrivateBin.Helper.urls2links(prefix + url + ' ' + postfix);
}
);
diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php
index c777171f..39a3364a 100644
--- a/tpl/bootstrap.php
+++ b/tpl/bootstrap.php
@@ -72,7 +72,7 @@ endif;
?>
-
+
diff --git a/tpl/page.php b/tpl/page.php
index 126c2a5f..3ad0b6e0 100644
--- a/tpl/page.php
+++ b/tpl/page.php
@@ -50,7 +50,7 @@ endif;
?>
-
+