blitzwing/cryptpad
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

reject protocol-relative URLs in 'parsePadURL'

Browse source
This commit is contained in:
ansuz 2020-12-11 17:48:15 +05:30
parent 5f9061cab1
commit 255527cc23
2 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
www/assert/main.js
View file

@ -334,6 +334,12 @@ define([
!secret.hashData.present);
}, "test support for ugly tracking query paramaters in url");
assert(function (cb) {
var url = '//cryptpad.fr/pad/#/2/pad/edit/oRE0oLCtEXusRDyin7GyLGcS/';
var parsed = Hash.isValidHref(url);
cb(!parsed);
}, "test that protocol relative URLs are rejected");
assert(function (cb) {
var keys = Block.genkeys(Nacl.randomBytes(64));
var hash = Block.getBlockHash(keys);
@ -349,7 +355,7 @@ define([
var v3 = Hash.isValidHref('/pad');
var v4 = Hash.isValidHref('/pad/');
var res = v1 && v2 && v3 && v4;
var res = Boolean(v1 && v2 && v3 && v4);
cb(res);
if (!res) {
console.log(v1, v2, v3, v4);
@ -361,7 +367,7 @@ define([
var v3 = Hash.isValidHref('/pad#'); // Invalid
var v4 = Hash.isValidHref('/pad/#');
var res = v1 && v2 && v3 && v4;
var res = Boolean(v1 && v2 && v3 && v4);
cb(res);
if (!res) {
console.log(v1, v2, v3, v4);
@ -373,7 +379,7 @@ define([
var v3 = Hash.isValidHref('https://cryptpad.fr/pad/#67b8385b07352be53e40746d2be6ccd7XAYSuJYYqa9NfmInyHci7LNy');
var v4 = Hash.isValidHref('/pad/#/2/pad/edit/HGu0tK2od-2BBnwAz2ZNS-t4/p/embed');
var res = v1 && v2 && v3 && v4;
var res = Boolean(v1 && v2 && v3 && v4);
cb(res);
if (!res) {
console.log(v1, v2, v3, v4);

2
www/common/common-hash.js
View file

@ -465,7 +465,7 @@ Version 4: Data URL when not a realtime link yet (new pad or "static" app)
if (!/^https*:\/\//.test(href)) {
// If it doesn't start with http(s), it should be a relative href
if (!/^\//.test(href)) { return ret; } // XXX this will allow protocol relative URLs
if (!/^\/($|[^\/])/.test(href)) { return ret; }
idx = href.indexOf('/#');
ret.type = href.slice(1, idx);
if (idx === -1) { return ret; }