self-hosted/joplin
1
0
Fork 0
mirror of https://github.com/laurent22/joplin.git synced 2025-06-12 22:57:38 +02:00
Code Issues Releases Activity

All: Security: Fixed potential Arbitrary File Read via XSS

Browse Source
This commit is contained in:
Laurent Cozic
2020-02-13 23:59:23 +00:00
parent 06d807d9ff
commit 3db47b575b
24 changed files with 434 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
ReactNativeClient/lib/joplin-renderer/htmlUtils.js
View File

@ -2,8 +2,11 @@ const Entities = require('html-entities').AllHtmlEntities;
const htmlentities = new Entities().encode;
// [\s\S] instead of . for multiline matching
const NodeHtmlParser = require('node-html-parser');
// https://stackoverflow.com/a/16119722/561309
const imageRegex = /<img([\s\S]*?)src=["']([\s\S]*?)["']([\s\S]*?)>/gi;
const JS_EVENT_NAMES = ['onabort', 'onafterprint', 'onbeforeprint', 'onbeforeunload', 'onblur', 'oncanplay', 'oncanplaythrough', 'onchange', 'onclick', 'oncontextmenu', 'oncopy', 'oncuechange', 'oncut', 'ondblclick', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'ondurationchange', 'onemptied', 'onended', 'onerror', 'onfocus', 'onhashchange', 'oninput', 'oninvalid', 'onkeydown', 'onkeypress', 'onkeyup', 'onload', 'onloadeddata', 'onloadedmetadata', 'onloadstart', 'onmessage', 'onmousedown', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onoffline', 'ononline', 'onpagehide', 'onpageshow', 'onpaste', 'onpause', 'onplay', 'onplaying', 'onpopstate', 'onprogress', 'onratechange', 'onreset', 'onresize', 'onscroll', 'onsearch', 'onseeked', 'onseeking', 'onselect', 'onstalled', 'onstorage', 'onsubmit', 'onsuspend', 'ontimeupdate', 'ontoggle', 'onunload', 'onvolumechange', 'onwaiting', 'onwheel'];
class HtmlUtils {
@ -43,6 +46,34 @@ class HtmlUtils {
});
}
sanitizeHtml(html) {
const walkHtmlNodes = (nodes) => {
if (!nodes || !nodes.length) return;
for (const node of nodes) {
for (const attr in node.attributes) {
if (!node.attributes.hasOwnProperty(attr)) continue;
if (JS_EVENT_NAMES.includes(attr)) node.setAttribute(attr, '');
}
walkHtmlNodes(node.childNodes);
}
};
// Need to wrap in div, otherwise elements at the root will be skipped
// The DIV tags are removed below
const dom = NodeHtmlParser.parse(`<div>${html}</div>`, {
script: false,
style: true,
pre: true,
comment: false,
});
walkHtmlNodes([dom]);
const output = dom.toString();
return output.substr(5, output.length - 11);
}
}
const htmlUtils = new HtmlUtils();