From fe297e1deaba19809286ebb9b3ad724fffef9047 Mon Sep 17 00:00:00 2001 From: Badlop Date: Tue, 3 Mar 2009 19:03:56 +0000 Subject: [PATCH] Merge 1879 from trunk. * src/mod_muc/mod_muc_log.erl: Prevent XSS in MUC logs by linkifying only a few known protocols (EJAB-850) SVN Revision: 1945 --- ChangeLog | 3 +++ src/mod_muc/mod_muc_log.erl | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 840ac58af..4dde5bf93 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ 2009-03-03 Badlop + * src/mod_muc/mod_muc_log.erl: Prevent XSS in MUC logs by + linkifying only a few known protocols (EJAB-850) + * src/mod_muc/mod_muc.erl: Export function to create MUC room (thanks to Eric Cestari) (EJAB-729) diff --git a/src/mod_muc/mod_muc_log.erl b/src/mod_muc/mod_muc_log.erl index 7f5c18718..01b3cda01 100644 --- a/src/mod_muc/mod_muc_log.erl +++ b/src/mod_muc/mod_muc_log.erl @@ -767,7 +767,8 @@ htmlize2(S1, NoFollow) -> S2 = element(2, regexp:gsub(S1, "\\&", "\\&")), S3 = element(2, regexp:gsub(S2, "<", "\\<")), S4 = element(2, regexp:gsub(S3, ">", "\\>")), - S5 = element(2, regexp:gsub(S4, "[-+.a-zA-Z0-9]+://[^] )\'\"}]+", link_regexp(NoFollow))), + S5 = element(2, regexp:gsub(S4, "(http|https|ftp|mailto|xmpp)://[^] )\'\"}]+", + link_regexp(NoFollow))), %% Remove 'right-to-left override' unicode character 0x202e element(2, regexp:gsub(S5, [226,128,174], "[RLO]")).