logo

pleroma-fe

My custom branche(s) on git.pleroma.social/pleroma/pleroma-fe git clone https://hacktivis.me/git/pleroma-fe.git
commit: 4bc7873e037dd4760c32e3dda4a94462696684e6
parent 3a507ba9b2fde594950a09c9d7934d54561a187c
Author: HJ <30-hj@users.noreply.git.pleroma.social>
Date:   Mon,  5 Jun 2023 19:04:30 +0000

Merge branch 'harden-parser' into 'develop'

fix regex misinterpreting tag name in badly formed HTML

See merge request pleroma/pleroma-fe!1835

(cherry picked from commit 624af7ed00b0edb2792f84cc83f6eeb7568798c4)

00b47e16 fix regex misinterpreting tag name in badly formed HTML, prevent rich
5e656cc0 Merge remote-tracking branch 'origin/develop' into harden-parser
10e28f6c changelog
0109724a case insensititvy

Diffstat:

Achangelog.d/parser.fix1+
Msrc/components/rich_content/rich_content.jsx4+++-
Msrc/services/html_converter/utility.service.js2+-
3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/changelog.d/parser.fix b/changelog.d/parser.fix @@ -0,0 +1 @@ +fix regex issue in HTML parser/renderer diff --git a/src/components/rich_content/rich_content.jsx b/src/components/rich_content/rich_content.jsx @@ -149,7 +149,9 @@ export default { // Handle tag nodes if (Array.isArray(item)) { const [opener, children, closer] = item - const Tag = getTagName(opener) + let Tag = getTagName(opener) + if (Tag.toLowerCase() === 'script') Tag = 'js-exploit' + if (Tag.toLowerCase() === 'style') Tag = 'css-exploit' const fullAttrs = getAttrs(opener, () => true) const attrs = getAttrs(opener) const previouslyMentions = currentMentions !== null diff --git a/src/services/html_converter/utility.service.js b/src/services/html_converter/utility.service.js @@ -5,7 +5,7 @@ * @return {String} - tagname, i.e. "div" */ export const getTagName = (tag) => { - const result = /(?:<\/(\w+)>|<(\w+)\s?.*?\/?>)/gi.exec(tag) + const result = /(?:<\/(\w+)>|<(\w+)\s?.*?\/?>)/gis.exec(tag) return result && (result[1] || result[2]) }