Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

feat($sanitize): Added support for the sftp protocol in $$ SanitizeUriProvider and linky filter #16102

Merged
merged 7 commits into from
Oct 11, 2017
Merged

feat($sanitize): Added support for the sftp protocol in $$ SanitizeUriProvider and linky filter #16102

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
edf903d
fix($$SanitizeUriProvider): added support for the sftp protocol in $$…
XFree Jul 12, 2017
345a0ba
test(compileSpec): fix allow aHrefSanitizationWhitelist
XFree Jul 12, 2017
47b5840
test($linkyFilter): add ftp and sftp tests
XFree Aug 15, 2017
01a4871
docs(linky): add sftp protocol
XFree Sep 7, 2017
c818c77
chore(sanitizeSpec): remove unused var
XFree Sep 8, 2017
1922577
chore($$SanitizeUriProvider): remove sftp from img Sanitization White…
XFree Sep 19, 2017
f35c17b
test(sanitizeUri): remove sftp test for img
XFree Sep 19, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/ng/sanitizeUri.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@
* Private service to sanitize uris for links and images. Used by $compile and $sanitize.
*/
function $$SanitizeUriProvider() {
var aHrefSanitizationWhitelist = /^\s*(https?|ftp|mailto|tel|file):/,
imgSrcSanitizationWhitelist = /^\s*((https?|ftp|file|blob):|data:image\/)/;
var aHrefSanitizationWhitelist = /^\s*(https?|s?ftp|mailto|tel|file):/,
imgSrcSanitizationWhitelist = /^\s*((https?|s?ftp|file|blob):|data:image\/)/;
Copy link
Contributor

@rjamet rjamet Sep 19, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, I missed this, sorry: is there a reason you're updating imgSrc too? I can see how navigational links could work, but if browsers don't support the protocol, images and such wouldn't work at all (Chrome seems to complain with Failed to load resource: net::ERR_UNKNOWN_URL_SCHEME at least).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm fix it.


/**
* @description
Expand Down
4 changes: 2 additions & 2 deletions src/ngSanitize/filter/linky.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
* @kind function
*
* @description
* Finds links in text input and turns them into html links. Supports `http/https/ftp/mailto` and
* Finds links in text input and turns them into html links. Supports `http/https/ftp/sftp/mailto` and
* plain email address links.
*
* Requires the {@link ngSanitize `ngSanitize`} module to be installed.
Expand Down Expand Up @@ -129,7 +129,7 @@
*/
angular.module('ngSanitize').filter('linky', ['$sanitize', function($sanitize) {
var LINKY_URL_REGEXP =
/((ftp|https?):\/\/|(www\.)|(mailto:)?[A-Za-z0-9._%+-]+@)\S*[^\s.;,(){}<>"\u201d\u2019]/i,
/((s?ftp|https?):\/\/|(www\.)|(mailto:)?[A-Za-z0-9._%+-]+@)\S*[^\s.;,(){}<>"\u201d\u2019]/i,
MAILTO_REGEXP = /^mailto:/i;

var linkyMinErr = angular.$$minErr('linky');
Expand Down
2 changes: 1 addition & 1 deletion test/ng/compileSpec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ describe('$compile', function() {

it('should allow aHrefSanitizationWhitelist to be configured', function() {
module(function($compileProvider) {
expect($compileProvider.aHrefSanitizationWhitelist()).toEqual(/^\s*(https?|ftp|mailto|tel|file):/); // the default
expect($compileProvider.aHrefSanitizationWhitelist()).toEqual(/^\s*(https?|s?ftp|mailto|tel|file):/); // the default
$compileProvider.aHrefSanitizationWhitelist(/other/);
expect($compileProvider.aHrefSanitizationWhitelist()).toEqual(/other/);
});
Expand Down
6 changes: 6 additions & 0 deletions test/ng/sanitizeUriSpec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,9 @@ describe('sanitizeUri', function() {
testUrl = 'ftp://foo.com/bar';
expect(sanitizeImg(testUrl)).toBe('ftp://foo.com/bar');

testUrl = 'sftp://foo.com/bar';
expect(sanitizeImg(testUrl)).toBe('sftp://foo.com/bar');

testUrl = 'file:///foo/bar.html';
expect(sanitizeImg(testUrl)).toBe('file:///foo/bar.html');
});
Expand Down Expand Up @@ -216,6 +219,9 @@ describe('sanitizeUri', function() {
testUrl = 'ftp://foo/bar';
expect(sanitizeHref(testUrl)).toBe('ftp://foo/bar');

testUrl = 'sftp://foo/bar';
expect(sanitizeHref(testUrl)).toBe('sftp://foo/bar');

testUrl = 'mailto:[email protected]';
expect(sanitizeHref(testUrl)).toBe('mailto:[email protected]');

Expand Down
4 changes: 4 additions & 0 deletions test/ngSanitize/filter/linkySpec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,10 @@ describe('linky', function() {
expect(linky('HTTP://example.com')).toEqual('<a href="HTTP://example.com">HTTP://example.com</a>');
expect(linky('HTTPS://www.example.com')).toEqual('<a href="HTTPS://www.example.com">HTTPS://www.example.com</a>');
expect(linky('HTTPS://example.com')).toEqual('<a href="HTTPS://example.com">HTTPS://example.com</a>');
expect(linky('FTP://www.example.com')).toEqual('<a href="FTP://www.example.com">FTP://www.example.com</a>');
expect(linky('FTP://example.com')).toEqual('<a href="FTP://example.com">FTP://example.com</a>');
expect(linky('SFTP://www.example.com')).toEqual('<a href="SFTP://www.example.com">SFTP://www.example.com</a>');
expect(linky('SFTP://example.com')).toEqual('<a href="SFTP://example.com">SFTP://example.com</a>');
});

it('should handle www.', function() {
Expand Down
3 changes: 2 additions & 1 deletion test/ngSanitize/sanitizeSpec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -270,7 +270,8 @@ describe('HTML', function() {

// See https://github.com/cure53/DOMPurify/blob/a992d3a75031cb8bb032e5ea8399ba972bdf9a65/src/purify.js#L439-L449
it('should not allow JavaScript execution when creating inert document', inject(function($sanitize) {
var doc = $sanitize('<svg><g onload="window.xxx = 100"></g></svg>');
$sanitize('<svg><g onload="window.xxx = 100"></g></svg>');

expect(window.xxx).toBe(undefined);
delete window.xxx;
}));
Expand Down