Merge branch 'harden-parser' into 'develop'

fix regex misinterpreting tag name in badly formed HTML

See merge request pleroma/pleroma-fe!1835
This commit is contained in:
HJ 2023-06-05 19:04:30 +00:00
commit 624af7ed00
3 changed files with 5 additions and 2 deletions

1
changelog.d/parser.fix Normal file
View File

@ -0,0 +1 @@
fix regex issue in HTML parser/renderer

View File

@ -149,7 +149,9 @@ export default {
// Handle tag nodes
if (Array.isArray(item)) {
const [opener, children, closer] = item
const Tag = getTagName(opener)
let Tag = getTagName(opener)
if (Tag.toLowerCase() === 'script') Tag = 'js-exploit'
if (Tag.toLowerCase() === 'style') Tag = 'css-exploit'
const fullAttrs = getAttrs(opener, () => true)
const attrs = getAttrs(opener)
const previouslyMentions = currentMentions !== null

View File

@ -5,7 +5,7 @@
* @return {String} - tagname, i.e. "div"
*/
export const getTagName = (tag) => {
const result = /(?:<\/(\w+)>|<(\w+)\s?.*?\/?>)/gi.exec(tag)
const result = /(?:<\/(\w+)>|<(\w+)\s?.*?\/?>)/gis.exec(tag)
return result && (result[1] || result[2])
}