specter/mastodon
1
0
Fork 0
forked from fedi/mastodon
Code Pull requests Activity

Escape URL parts on formatting local status (#4975)

Browse source
This commit is contained in:
unarist 2017-09-17 04:33:52 +09:00 committed by Eugen Rochko
parent c8969dca35
commit ec36df97c4
2 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/lib/formatter.rb
View file

@ -137,7 +137,7 @@ class Formatter
suffix = url[prefix.length + 30..-1]
cutoff = url[prefix.length..-1].length > 30
"<span class=\"invisible\">#{prefix}</span><span class=\"#{cutoff ? 'ellipsis' : ''}\">#{text}</span><span class=\"invisible\">#{suffix}</span>"
"<span class=\"invisible\">#{encode(prefix)}</span><span class=\"#{cutoff ? 'ellipsis' : ''}\">#{encode(text)}</span><span class=\"invisible\">#{encode(suffix)}</span>"
end
def hashtag_html(tag)

16
spec/lib/formatter_spec.rb
View file

@ -121,6 +121,22 @@ RSpec.describe Formatter do
end
end
context 'contains unsafe URL (XSS attack, visible part)' do
let(:text) { %q{http://example.com/b<del>b</del>} }
it 'has escaped HTML' do
is_expected.to include '&lt;del&gt;b&lt;/del&gt;'
end
end
context 'contains unsafe URL (XSS attack, invisible part)' do
let(:text) { %q{http://example.com/blahblahblahblah/a<script>alert("Hello")</script>} }
it 'has escaped HTML' do
is_expected.to include '&lt;script&gt;alert(&quot;Hello&quot;)&lt;/script&gt;'
end
end
context 'contains HTML (script tag)' do
let(:text) { '<script>alert("Hello")</script>' }