diff options
author | Mario <mario@mariovavti.com> | 2023-06-02 16:36:57 +0000 |
---|---|---|
committer | Mario <mario@mariovavti.com> | 2023-06-02 16:36:57 +0000 |
commit | bd84ff483887c55c6ede4ba94e1a9175e34090b8 (patch) | |
tree | 799929705f903f4ba4111ca37d5028180371b621 /vendor/twbs/bootstrap/js/src/util/sanitizer.js | |
parent | 87689df062f09adf104ff996b7bc942ba508a2b4 (diff) | |
download | volse-hubzilla-bd84ff483887c55c6ede4ba94e1a9175e34090b8.tar.gz volse-hubzilla-bd84ff483887c55c6ede4ba94e1a9175e34090b8.tar.bz2 volse-hubzilla-bd84ff483887c55c6ede4ba94e1a9175e34090b8.zip |
update bootstrap to version 5.3
Diffstat (limited to 'vendor/twbs/bootstrap/js/src/util/sanitizer.js')
-rw-r--r-- | vendor/twbs/bootstrap/js/src/util/sanitizer.js | 78 |
1 files changed, 36 insertions, 42 deletions
diff --git a/vendor/twbs/bootstrap/js/src/util/sanitizer.js b/vendor/twbs/bootstrap/js/src/util/sanitizer.js index 5a07a67c1..d2b08082c 100644 --- a/vendor/twbs/bootstrap/js/src/util/sanitizer.js +++ b/vendor/twbs/bootstrap/js/src/util/sanitizer.js @@ -5,47 +5,6 @@ * -------------------------------------------------------------------------- */ -const uriAttributes = new Set([ - 'background', - 'cite', - 'href', - 'itemtype', - 'longdesc', - 'poster', - 'src', - 'xlink:href' -]) - -/** - * A pattern that recognizes a commonly useful subset of URLs that are safe. - * - * Shout-out to Angular https://github.com/angular/angular/blob/12.2.x/packages/core/src/sanitization/url_sanitizer.ts - */ -const SAFE_URL_PATTERN = /^(?:(?:https?|mailto|ftp|tel|file|sms):|[^#&/:?]*(?:[#/?]|$))/i - -/** - * A pattern that matches safe data URLs. Only matches image, video and audio types. - * - * Shout-out to Angular https://github.com/angular/angular/blob/12.2.x/packages/core/src/sanitization/url_sanitizer.ts - */ -const DATA_URL_PATTERN = /^data:(?:image\/(?:bmp|gif|jpeg|jpg|png|tiff|webp)|video\/(?:mpeg|mp4|ogg|webm)|audio\/(?:mp3|oga|ogg|opus));base64,[\d+/a-z]+=*$/i - -const allowedAttribute = (attribute, allowedAttributeList) => { - const attributeName = attribute.nodeName.toLowerCase() - - if (allowedAttributeList.includes(attributeName)) { - if (uriAttributes.has(attributeName)) { - return Boolean(SAFE_URL_PATTERN.test(attribute.nodeValue) || DATA_URL_PATTERN.test(attribute.nodeValue)) - } - - return true - } - - // Check if a regular expression validates the attribute. - return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp) - .some(regex => regex.test(attributeName)) -} - // js-docs-start allow-list const ARIA_ATTRIBUTE_PATTERN = /^aria-[\w-]*$/i @@ -84,6 +43,42 @@ export const DefaultAllowlist = { } // js-docs-end allow-list +const uriAttributes = new Set([ + 'background', + 'cite', + 'href', + 'itemtype', + 'longdesc', + 'poster', + 'src', + 'xlink:href' +]) + +/** + * A pattern that recognizes URLs that are safe wrt. XSS in URL navigation + * contexts. + * + * Shout-out to Angular https://github.com/angular/angular/blob/15.2.8/packages/core/src/sanitization/url_sanitizer.ts#L38 + */ +// eslint-disable-next-line unicorn/better-regex +const SAFE_URL_PATTERN = /^(?!javascript:)(?:[a-z0-9+.-]+:|[^&:/?#]*(?:[/?#]|$))/i + +const allowedAttribute = (attribute, allowedAttributeList) => { + const attributeName = attribute.nodeName.toLowerCase() + + if (allowedAttributeList.includes(attributeName)) { + if (uriAttributes.has(attributeName)) { + return Boolean(SAFE_URL_PATTERN.test(attribute.nodeValue)) + } + + return true + } + + // Check if a regular expression validates the attribute. + return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp) + .some(regex => regex.test(attributeName)) +} + export function sanitizeHtml(unsafeHtml, allowList, sanitizeFunction) { if (!unsafeHtml.length) { return unsafeHtml @@ -102,7 +97,6 @@ export function sanitizeHtml(unsafeHtml, allowList, sanitizeFunction) { if (!Object.keys(allowList).includes(elementName)) { element.remove() - continue } |