From 005d223c0dfa262f8dd2ba5358f1b1c5093e71e9 Mon Sep 17 00:00:00 2001 From: rugk Date: Wed, 4 Mar 2020 11:45:56 +0100 Subject: [PATCH] Fix source code being not rendered If special characters were included the source code (HTML-like ones like < and >) is was not rendered. Fixes https://github.com/PrivateBin/PrivateBin/issues/588 It includes a change in the RegEx for URLs because that was broken when a & character later followed at any time after a link (even after a newline). (with a negative lookahead) Test with https://regex101.com/r/i7bZ73/1 Now the RegEx does not check for _all_ chars after a link, but just for the one following the link. (So the lookahead is not * anymore. I guess thsi behaviour was the expectation when it has been implemented.) --- js/privatebin.js | 10 +++++++++- tpl/bootstrap.php | 24 ++++++++++++------------ tpl/page.php | 22 +++++++++++----------- 3 files changed, 32 insertions(+), 24 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index 139ecc73..7dc8b4ef 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -392,7 +392,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { me.urls2links = function(html) { return html.replace( - /(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]*>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig, + /(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig, '$1' ); }; @@ -2504,6 +2504,14 @@ jQuery.PrivateBin = (function($, RawDeflate) { return; } + // encode < to make sure DomPurify does not interpret e.g. HTML or XML markup as code + // cf. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/xmp#Summary + // As Markdown, by definition, is/allows HTML code, we do not do anything there. + if (format !== 'markdown') { + // one character is enough, as this is not security-relevant (all output will go through DOMPurify later) + text = text.replace(/ - + - + - + - - - - + + + + - + - + - - - + + + diff --git a/tpl/page.php b/tpl/page.php index 171f997f..7ffbe946 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -20,37 +20,37 @@ if ($SYNTAXHIGHLIGHTING): endif; endif; ?> - + - + - + - - - + + + - + - + - - - + + +