twisterarmy/twister-html
1
0
Fork 0
mirror of https://github.com/twisterarmy/twister-html.git synced 2025-03-12 05:21:18 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #271 from slr/tasty-markdown

Browse Source 
excluding XSS exploitable link handling
This commit is contained in:
miguelfreitas 2015-07-15 20:05:06 -03:00
commit 34de291822
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/twister_formatpost.js
View File

@ -439,7 +439,7 @@ function htmlFormatMsg(msg, mentions) {
msg = markdown(escapeHtmlEntities(msg), msg = markdown(escapeHtmlEntities(msg),
'`', 'samp'); // kind of monospace, sequence of chars inside will be escaped from markup '`', 'samp'); // kind of monospace, sequence of chars inside will be escaped from markup
for (i = 0; i < msg.length - 7; i++) { for (i = 0; i < msg.length - 7; i++) {
if (msg.slice(i, i + 2) === '](') { /*if (msg.slice(i, i + 2) === '](') {
// FIXME there can be text with [] inside [] or links with () wee need to handle it too // FIXME there can be text with [] inside [] or links with () wee need to handle it too
j = getStrStart(msg, i - 1, '[', true, ''); j = getStrStart(msg, i - 1, '[', true, '');
if (j < i) { if (j < i) {
@ -457,6 +457,8 @@ function htmlFormatMsg(msg, mentions) {
'_', 'u'), // underlined '_', 'u'), // underlined
'-', 's') // striketrough '-', 's') // striketrough
.replace(/&(?!lt;|gt;)/g, '&amp;') .replace(/&(?!lt;|gt;)/g, '&amp;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&apos;')
) )
+ '$2') // $().closest('a').text(url) + '$2') // $().closest('a').text(url)
); );
@ -465,7 +467,7 @@ function htmlFormatMsg(msg, mentions) {
i = j + strEncoded.length - 1; i = j + strEncoded.length - 1;
} }
} }
} else if (msg.slice(i, i + 4).toLowerCase() === 'http') { } else*/ if (msg.slice(i, i + 4).toLowerCase() === 'http') {
if (msg.slice(i + 4, i + 7) === '://' && stopCharsRight.indexOf(msg[i + 7]) === -1) { if (msg.slice(i + 4, i + 7) === '://' && stopCharsRight.indexOf(msg[i + 7]) === -1) {
j = getStrEnd(msg, i + 7, stopCharsRight, false, stopCharsTrailingUrl); j = getStrEnd(msg, i + 7, stopCharsRight, false, stopCharsTrailingUrl);
if (j > i + 6) { if (j > i + 6) {