Web UI: augment sanitize() function
to allow parameterized RE generation from evillist.
Change-Id: I0c41b973c1fdbac190d22806f08bb6fe107a7118
diff --git a/web/gui/src/main/webapp/app/fw/util/fn.js b/web/gui/src/main/webapp/app/fw/util/fn.js
index 9706478..2d55623 100644
--- a/web/gui/src/main/webapp/app/fw/util/fn.js
+++ b/web/gui/src/main/webapp/app/fw/util/fn.js
@@ -436,11 +436,11 @@
var matcher = /<\/?([a-zA-Z0-9]+)*(.*?)\/?>/igm,
whitelist = ['b', 'i', 'p', 'em', 'strong'],
- warnlist = ['script', 'style'];
+ evillist = ['script', 'style', 'iframe'];
- // Returns true if the tag is in the warn list, (and is not an end-tag)
- function inWarnList(tag) {
- return (warnlist.indexOf(tag.name) !== -1 && tag.full.indexOf('/') === -1);
+ // Returns true if the tag is in the evil list, (and is not an end-tag)
+ function inEvilList(tag) {
+ return (evillist.indexOf(tag.name) !== -1 && tag.full.indexOf('/') === -1);
}
function analyze(html) {
@@ -466,15 +466,17 @@
var matches = analyze(html);
- // do not allow script tags or style tags
- html = html.replace(/<script(.*?)>(.*?[\r\n])*?(.*?)(.*?[\r\n])*?<\/script>/gim, '');
- html = html.replace(/<style(.*?)>(.*?[\r\n])*?(.*?)(.*?[\r\n])*?<\/style>/gim, '');
+ // completely obliterate evil tags and their contents...
+ evillist.forEach(function (tag) {
+ var re = new RegExp('<' + tag + '(.*?)>(.*?[\r\n])*?(.*?)(.*?[\r\n])*?<\/' + tag + '>', 'gim');
+ html = html.replace(re, '');
+ });
- // filter out all but whitelisted tag types
+ // filter out all but white-listed tags and end-tags
matches.forEach(function (tag) {
if (whitelist.indexOf(tag.name) === -1) {
html = html.replace(tag.full, '');
- if (inWarnList(tag)) {
+ if (inEvilList(tag)) {
$log.warn('Unsanitary HTML input -- ' + tag.full + ' detected!');
}
}
diff --git a/web/gui/src/main/webapp/tests/app/fw/util/fn-spec.js b/web/gui/src/main/webapp/tests/app/fw/util/fn-spec.js
index a7bda70..257c90d 100644
--- a/web/gui/src/main/webapp/tests/app/fw/util/fn-spec.js
+++ b/web/gui/src/main/webapp/tests/app/fw/util/fn-spec.js
@@ -480,6 +480,15 @@
);
});
+
+ it('should log a warning for < iframe > tags', function () {
+ spyOn($log, 'warn');
+ chkSan('Foo<iframe><body><h1>fake</h1></body></iframe>Bar', 'FooBar');
+ expect($log.warn).toHaveBeenCalledWith(
+ 'Unsanitary HTML input -- <iframe> detected!'
+ );
+ });
+
it('should completely strip < script >, remove < a >, retain < i >', function () {
chkSan(
'Hey <i>this</i> is <script>alert("foo");</script> <a href="meh">cool</a>',