Don't render unescaped urls.
This commit is contained in:
parent
5a1b308edd
commit
b6fcc9b79d
@ -862,11 +862,6 @@
|
||||
});
|
||||
|
||||
it("will have properly escaped URLs", function () {
|
||||
if (/PhantomJS/.test(window.navigator.userAgent)) {
|
||||
// Flaky under PhantomJS due to timeouts
|
||||
return;
|
||||
}
|
||||
// TODO: make these local urls
|
||||
var message, msg;
|
||||
var contact_jid = mock.cur_names[0].replace(/ /g,'.').toLowerCase() + '@localhost';
|
||||
test_utils.openChatBoxFor(contact_jid);
|
||||
@ -876,7 +871,7 @@
|
||||
message = "http://www.opkode.com/'onmouseover='alert(1)'whatever";
|
||||
test_utils.sendMessage(view, message);
|
||||
});
|
||||
waits(500);
|
||||
waits(50);
|
||||
runs(function () {
|
||||
expect(view.sendMessage).toHaveBeenCalled();
|
||||
msg = view.$el.find('.chat-content').find('.chat-message').last().find('.chat-msg-content');
|
||||
@ -886,7 +881,7 @@
|
||||
message = 'http://www.opkode.com/"onmouseover="alert(1)"whatever';
|
||||
test_utils.sendMessage(view, message);
|
||||
});
|
||||
waits(500);
|
||||
waits(50);
|
||||
runs(function () {
|
||||
expect(view.sendMessage).toHaveBeenCalled();
|
||||
msg = view.$el.find('.chat-content').find('.chat-message').last().find('.chat-msg-content');
|
||||
@ -896,7 +891,7 @@
|
||||
message = "https://en.wikipedia.org/wiki/Ender's_Game";
|
||||
test_utils.sendMessage(view, message);
|
||||
});
|
||||
waits(500);
|
||||
waits(50);
|
||||
runs(function () {
|
||||
expect(view.sendMessage).toHaveBeenCalled();
|
||||
msg = view.$el.find('.chat-content').find('.chat-message').last().find('.chat-msg-content');
|
||||
@ -906,7 +901,7 @@
|
||||
message = "https://en.wikipedia.org/wiki/Ender%27s_Game";
|
||||
test_utils.sendMessage(view, message);
|
||||
});
|
||||
waits(500);
|
||||
waits(50);
|
||||
runs(function () {
|
||||
expect(view.sendMessage).toHaveBeenCalled();
|
||||
msg = view.$el.find('.chat-content').find('.chat-message').last().find('.chat-msg-content');
|
||||
|
32
src/utils.js
32
src/utils.js
@ -49,21 +49,27 @@
|
||||
$.fn.addHyperlinks = function () {
|
||||
if (this.length > 0) {
|
||||
this.each(function (i, obj) {
|
||||
var prot, escaped_url;
|
||||
var $obj = $(obj);
|
||||
var x = $obj.html();
|
||||
_.each(x.match(/\b(https?:\/\/|www\.|https?:\/\/www\.)[^\s<]{2,200}\b/g), function (url) {
|
||||
isImage(url)
|
||||
.then(function () {
|
||||
event.target.className = 'chat-image';
|
||||
x = x.replace(url, event.target.outerHTML);
|
||||
$obj.throttledHTML(x);
|
||||
})
|
||||
.fail(function () {
|
||||
var prot = url.indexOf('http://') === 0 || url.indexOf('https://') === 0 ? '' : 'http://';
|
||||
var escaped_url = encodeURI(decodeURI(url)).replace(/[!'()]/g, escape).replace(/\*/g, "%2A");
|
||||
x = x.replace(url, '<a target="_blank" rel="noopener" href="' + prot + escaped_url + '">'+ url + '</a>' );
|
||||
$obj.throttledHTML(x);
|
||||
});
|
||||
var list = x.match(/\b(https?:\/\/|www\.|https?:\/\/www\.)[^\s<]{2,200}\b/g );
|
||||
if (list) {
|
||||
for (i=0; i<list.length; i++) {
|
||||
prot = list[i].indexOf('http://') === 0 || list[i].indexOf('https://') === 0 ? '' : 'http://';
|
||||
escaped_url = encodeURI(decodeURI(list[i])).replace(/[!'()]/g, escape).replace(/\*/g, "%2A");
|
||||
x = x.replace(list[i], '<a target="_blank" rel="noopener" href="' + prot + escaped_url + '">'+ list[i] + '</a>' );
|
||||
}
|
||||
}
|
||||
$obj.html(x);
|
||||
_.each(list, function (url) {
|
||||
isImage(url).then(function () {
|
||||
var prot = url.indexOf('http://') === 0 || url.indexOf('https://') === 0 ? '' : 'http://';
|
||||
var escaped_url = encodeURI(decodeURI(url)).replace(/[!'()]/g, escape).replace(/\*/g, "%2A");
|
||||
var new_url = '<a target="_blank" rel="noopener" href="' + prot + escaped_url + '">'+ url + '</a>';
|
||||
event.target.className = 'chat-image';
|
||||
x = x.replace(new_url, event.target.outerHTML);
|
||||
$obj.throttledHTML(x);
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user