From 5340f417e07fdfdab2f91f5171f4f992bc763a73 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sat, 29 Feb 2020 09:37:54 +0100 Subject: [PATCH] in Helper.urls2links(), encode HTML entities, find and insert links, partially decoding only the href property of it --- js/privatebin.js | 23 +++++++++++++++++++---- js/test/Helper.js | 11 ++++------- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 4 files changed, 25 insertions(+), 13 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index d2b85448..9e2b0ee2 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -297,10 +297,25 @@ jQuery.PrivateBin = (function($, RawDeflate) { */ me.urls2links = function(html) { - return html.replace( - /(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]*>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig, - '$1' - ); + let reverseEntityMap = {}; + for (let entity of ['&', '"', '/', '=']) { + reverseEntityMap[entityMap[entity]] = entity; + } + const entityRegex = new RegExp(Object.keys(reverseEntityMap).join('|'), 'g'); + + // encode HTML entities, find and insert links, partially decoding only the href property of it + return me.htmlEntities(html) + .replace( + /(((https?|ftp)://[\w?!&.-;#@~%+*-]+(?![\w\s?!&.;#~%-]*>))|((magnet):[\w?&.-;#@~%+*-]+))/ig, + function(encodedUrl) { + let decodedUrl = encodedUrl.replace( + entityRegex, function(entity) { + return reverseEntityMap[entity]; + } + ); + return '' + encodedUrl + ''; + } + ) }; /** diff --git a/js/test/Helper.js b/js/test/Helper.js index dd38e3c4..a884eee2 100644 --- a/js/test/Helper.js +++ b/js/test/Helper.js @@ -81,7 +81,7 @@ describe('Helper', function () { 'ignores non-URL content', 'string', function (content) { - return content === $.PrivateBin.Helper.urls2links(content); + return $.PrivateBin.Helper.htmlEntities(content) === $.PrivateBin.Helper.urls2links(content); } ); jsc.property( @@ -95,8 +95,7 @@ describe('Helper', function () { function (prefix, schema, address, query, fragment, postfix) { query = query.join(''); fragment = fragment.join(''); - prefix = $.PrivateBin.Helper.htmlEntities(prefix); - postfix = ' ' + $.PrivateBin.Helper.htmlEntities(postfix); + postfix = ' ' + postfix; let url = schema + '://' + address.join('') + '/?' + query + '#' + fragment; // special cases: When the query string and fragment imply the beginning of an HTML entity, eg. � or &#x @@ -109,7 +108,7 @@ describe('Helper', function () { postfix = ''; } - return prefix + '' + url + '' + postfix === $.PrivateBin.Helper.urls2links(prefix + url + postfix); + return $.PrivateBin.Helper.htmlEntities(prefix) + '' + $.PrivateBin.Helper.htmlEntities(url) + '' + $.PrivateBin.Helper.htmlEntities(postfix) === $.PrivateBin.Helper.urls2links(prefix + url + postfix); } ); jsc.property( @@ -118,10 +117,8 @@ describe('Helper', function () { jsc.array(common.jscQueryString()), 'string', function (prefix, query, postfix) { - prefix = $.PrivateBin.Helper.htmlEntities(prefix); - postfix = $.PrivateBin.Helper.htmlEntities(postfix); let url = 'magnet:?' + query.join('').replace(/^&+|&+$/gm,''); - return prefix + '' + url + ' ' + postfix === $.PrivateBin.Helper.urls2links(prefix + url + ' ' + postfix); + return $.PrivateBin.Helper.htmlEntities(prefix) + '' + $.PrivateBin.Helper.htmlEntities(url) + ' ' + $.PrivateBin.Helper.htmlEntities(postfix) === $.PrivateBin.Helper.urls2links(prefix + url + ' ' + postfix); } ); }); diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 843dc6a7..ba47c27a 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -72,7 +72,7 @@ endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index c976ce2f..9d66a861 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -50,7 +50,7 @@ endif; ?> - +