Anon/yandere_fe
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'harden-parser' into 'develop'

Browse Source 
fix regex misinterpreting tag name in badly formed HTML

See merge request pleroma/pleroma-fe!1835
This commit is contained in:
HJ 2023-06-05 19:04:30 +00:00
commit 624af7ed00
3 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/parser.fix Normal file
View File

@ -0,0 +1 @@
fix regex issue in HTML parser/renderer

4
src/components/rich_content/rich_content.jsx
View File

@ -149,7 +149,9 @@ export default {
// Handle tag nodes // Handle tag nodes
if (Array.isArray(item)) { if (Array.isArray(item)) {
const [opener, children, closer] = item const [opener, children, closer] = item
const Tag = getTagName(opener) let Tag = getTagName(opener)
if (Tag.toLowerCase() === 'script') Tag = 'js-exploit'
if (Tag.toLowerCase() === 'style') Tag = 'css-exploit'
const fullAttrs = getAttrs(opener, () => true) const fullAttrs = getAttrs(opener, () => true)
const attrs = getAttrs(opener) const attrs = getAttrs(opener)
const previouslyMentions = currentMentions !== null const previouslyMentions = currentMentions !== null

2
src/services/html_converter/utility.service.js
View File

@ -5,7 +5,7 @@
* @return {String} - tagname, i.e. "div" * @return {String} - tagname, i.e. "div"
*/ */
export const getTagName = (tag) => { export const getTagName = (tag) => {
const result = /(?:<\/(\w+)>|<(\w+)\s?.*?\/?>)/gi.exec(tag) const result = /(?:<\/(\w+)>|<(\w+)\s?.*?\/?>)/gis.exec(tag)
return result && (result[1] || result[2]) return result && (result[1] || result[2])
} }