Chapril/xmpp.chapril.org-conversejs
Chapril/xmpp.chapril.org-conversejs
25
0
Fork 0
Code Issues Pull Requests Projects Releases Activity

Don't render unescaped urls.

Browse Source
This commit is contained in:
JC Brand 2016-05-28 11:28:32 +00:00
parent 5a1b308edd
commit b6fcc9b79d
2 changed files with 23 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
spec/chatbox.js
View File

@ -862,11 +862,6 @@
});
it("will have properly escaped URLs", function () {
if (/PhantomJS/.test(window.navigator.userAgent)) {
// Flaky under PhantomJS due to timeouts
return;
}
// TODO: make these local urls
var message, msg;
var contact_jid = mock.cur_names[0].replace(/ /g,'.').toLowerCase() + '@localhost';
test_utils.openChatBoxFor(contact_jid);
@ -876,7 +871,7 @@
message = "http://www.opkode.com/'onmouseover='alert(1)'whatever";
test_utils.sendMessage(view, message);
});
waits(500);
waits(50);
runs(function () {
expect(view.sendMessage).toHaveBeenCalled();
msg = view.$el.find('.chat-content').find('.chat-message').last().find('.chat-msg-content');
@ -886,7 +881,7 @@
message = 'http://www.opkode.com/"onmouseover="alert(1)"whatever';
test_utils.sendMessage(view, message);
});
waits(500);
waits(50);
runs(function () {
expect(view.sendMessage).toHaveBeenCalled();
msg = view.$el.find('.chat-content').find('.chat-message').last().find('.chat-msg-content');
@ -896,7 +891,7 @@
message = "https://en.wikipedia.org/wiki/Ender's_Game";
test_utils.sendMessage(view, message);
});
waits(500);
waits(50);
runs(function () {
expect(view.sendMessage).toHaveBeenCalled();
msg = view.$el.find('.chat-content').find('.chat-message').last().find('.chat-msg-content');
@ -906,7 +901,7 @@
message = "https://en.wikipedia.org/wiki/Ender%27s_Game";
test_utils.sendMessage(view, message);
});
waits(500);
waits(50);
runs(function () {
expect(view.sendMessage).toHaveBeenCalled();
msg = view.$el.find('.chat-content').find('.chat-message').last().find('.chat-msg-content');

24
src/utils.js
View File

@ -49,19 +49,25 @@
$.fn.addHyperlinks = function () {
if (this.length > 0) {
this.each(function (i, obj) {
var prot, escaped_url;
var $obj = $(obj);
var x = $obj.html();
_.each(x.match(/\b(https?:\/\/|www\.|https?:\/\/www\.)[^\s<]{2,200}\b/g), function (url) {
isImage(url)
.then(function () {
event.target.className = 'chat-image';
x = x.replace(url, event.target.outerHTML);
$obj.throttledHTML(x);
})
.fail(function () {
var list = x.match(/\b(https?:\/\/|www\.|https?:\/\/www\.)[^\s<]{2,200}\b/g );
if (list) {
for (i=0; i<list.length; i++) {
prot = list[i].indexOf('http://') === 0 || list[i].indexOf('https://') === 0 ? '' : 'http://';
escaped_url = encodeURI(decodeURI(list[i])).replace(/[!'()]/g, escape).replace(/\*/g, "%2A");
x = x.replace(list[i], '<a target="_blank" rel="noopener" href="' + prot + escaped_url + '">'+ list[i] + '</a>' );
}
}
$obj.html(x);
_.each(list, function (url) {
isImage(url).then(function () {
var prot = url.indexOf('http://') === 0 || url.indexOf('https://') === 0 ? '' : 'http://';
var escaped_url = encodeURI(decodeURI(url)).replace(/[!'()]/g, escape).replace(/\*/g, "%2A");
x = x.replace(url, '<a target="_blank" rel="noopener" href="' + prot + escaped_url + '">'+ url + '</a>' );
var new_url = '<a target="_blank" rel="noopener" href="' + prot + escaped_url + '">'+ url + '</a>';
event.target.className = 'chat-image';
x = x.replace(new_url, event.target.outerHTML);
$obj.throttledHTML(x);
});
});