github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-22 09:42:02 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Correctly parse URLs in chat excerpts

Browse Source
This commit is contained in:
Jan Cernik 2024-09-03 15:26:32 -03:00 committed by Alan Guo Xiang Tan
parent 07f6952beb
commit 1da97de7f0
No known key found for this signature in database
GPG Key ID: 286D2AB58F8C86B6
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
plugins/chat/app/models/chat/message.rb
View File

@ -122,7 +122,14 @@ module Chat
def build_excerpt def build_excerpt
# just show the URL if the whole message is a URL, because we cannot excerpt oneboxes # just show the URL if the whole message is a URL, because we cannot excerpt oneboxes
return message if UrlHelper.relaxed_parse(message).is_a?(URI) urls = PrettyText.extract_links(cooked).map(&:url)
if urls.present?
regex = %r{^[^:]+://}
clean_urls = urls.map { |url| url.sub(regex, "") }
if message.gsub(regex, "").split.sort == clean_urls.sort
return PrettyText.excerpt(urls.join(" "), EXCERPT_LENGTH)
end
end
# upload-only messages are better represented as the filename # upload-only messages are better represented as the filename
return uploads.first.original_filename if cooked.blank? && uploads.present? return uploads.first.original_filename if cooked.blank? && uploads.present?

9
plugins/chat/spec/system/chat_channel_spec.rb
View File

@ -296,6 +296,15 @@ RSpec.describe "Chat channel", type: :system do
) )
end end
it "renders escaped HTML when including a #" do
update_message!(message_2, user: other_user, text: "#general <abbr>not abbr</abbr>")
chat_page.visit_channel(channel_1)
expect(find(".chat-reply .chat-reply__excerpt")["innerHTML"].strip).to eq(
"#general &lt;abbr&gt;not abbr&lt;/abbr&gt;",
)
end
it "renders safe HTML like mentions (which are just links) in the reply-to" do it "renders safe HTML like mentions (which are just links) in the reply-to" do
update_message!( update_message!(
message_2, message_2,