No OneTemporary
Actions

Size

14 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/priv/scrubbers/default.ex b/priv/scrubbers/default.ex
	index 4694a92a5..d3561f169 100644
	--- a/priv/scrubbers/default.ex
	+++ b/priv/scrubbers/default.ex
	@@ -1,101 +1,102 @@
	defmodule Pleroma.HTML.Scrubber.Default do
	@doc "The default HTML scrubbing policy: no "

	require FastSanitize.Sanitizer.Meta
	alias FastSanitize.Sanitizer.Meta

	# credo:disable-for-previous-line
	# No idea how to fix this one…

	@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])

	Meta.strip_comments()

	Meta.allow_tag_with_uri_attributes(:a, ["href", "data-user", "data-tag"], @valid_schemes)

	Meta.allow_tag_with_this_attribute_values(:a, "class", [
	"hashtag",
	"u-url",
	"mention",
	"u-url mention",
	"mention u-url"
	])

	Meta.allow_tag_with_this_attribute_values(:a, "rel", [
	"tag",
	"nofollow",
	"noopener",
	"noreferrer",
	"ugc"
	])

	Meta.allow_tag_with_these_attributes(:a, ["name", "title"])

	Meta.allow_tag_with_these_attributes(:abbr, ["title"])

	Meta.allow_tag_with_these_attributes(:b, [])
	Meta.allow_tag_with_these_attributes(:blockquote, [])
	Meta.allow_tag_with_these_attributes(:br, [])
	Meta.allow_tag_with_these_attributes(:code, [])
	Meta.allow_tag_with_these_attributes(:del, [])
	Meta.allow_tag_with_these_attributes(:em, [])
	Meta.allow_tag_with_these_attributes(:hr, [])
	Meta.allow_tag_with_these_attributes(:i, [])
	Meta.allow_tag_with_these_attributes(:li, [])
	Meta.allow_tag_with_these_attributes(:ol, [])
	Meta.allow_tag_with_these_attributes(:p, [])
	Meta.allow_tag_with_these_attributes(:pre, [])
	Meta.allow_tag_with_these_attributes(:strong, [])
	Meta.allow_tag_with_these_attributes(:sub, [])
	Meta.allow_tag_with_these_attributes(:sup, [])
	Meta.allow_tag_with_these_attributes(:ruby, [])
	Meta.allow_tag_with_these_attributes(:rb, [])
	Meta.allow_tag_with_these_attributes(:rp, [])
	Meta.allow_tag_with_these_attributes(:rt, [])
	Meta.allow_tag_with_these_attributes(:rtc, [])
	Meta.allow_tag_with_these_attributes(:u, [])
	Meta.allow_tag_with_these_attributes(:ul, [])

	Meta.allow_tag_with_this_attribute_values(:span, "class", ["h-card"])
	Meta.allow_tag_with_these_attributes(:span, [])

	Meta.allow_tag_with_this_attribute_values(:code, "class", ["inline"])

	@allow_inline_images Pleroma.Config.get([:markup, :allow_inline_images])

	if @allow_inline_images do
	+ Meta.allow_tag_with_this_attribute_values(:img, "class", ["emoji"])
	+
	# restrict img tags to http/https only, because of MediaProxy.
	Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])

	Meta.allow_tag_with_these_attributes(:img, [
	"width",
	"height",
	- "class",
	"title",
	"alt"
	])
	end

	if Pleroma.Config.get([:markup, :allow_tables]) do
	Meta.allow_tag_with_these_attributes(:table, [])
	Meta.allow_tag_with_these_attributes(:tbody, [])
	Meta.allow_tag_with_these_attributes(:td, [])
	Meta.allow_tag_with_these_attributes(:th, [])
	Meta.allow_tag_with_these_attributes(:thead, [])
	Meta.allow_tag_with_these_attributes(:tr, [])
	end

	if Pleroma.Config.get([:markup, :allow_headings]) do
	Meta.allow_tag_with_these_attributes(:h1, [])
	Meta.allow_tag_with_these_attributes(:h2, [])
	Meta.allow_tag_with_these_attributes(:h3, [])
	Meta.allow_tag_with_these_attributes(:h4, [])
	Meta.allow_tag_with_these_attributes(:h5, [])
	end

	if Pleroma.Config.get([:markup, :allow_fonts]) do
	Meta.allow_tag_with_these_attributes(:font, ["face"])
	end

	Meta.strip_everything_not_covered()
	end
	diff --git a/priv/scrubbers/twitter_text.ex b/priv/scrubbers/twitter_text.ex
	index c4e796cad..bb8f3bc50 100644
	--- a/priv/scrubbers/twitter_text.ex
	+++ b/priv/scrubbers/twitter_text.ex
	@@ -1,57 +1,58 @@
	defmodule Pleroma.HTML.Scrubber.TwitterText do
	@moduledoc """
	An HTML scrubbing policy which limits to twitter-style text. Only
	paragraphs, breaks and links are allowed through the filter.
	"""

	@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])

	require FastSanitize.Sanitizer.Meta
	alias FastSanitize.Sanitizer.Meta

	Meta.strip_comments()

	# links
	Meta.allow_tag_with_uri_attributes(:a, ["href", "data-user", "data-tag"], @valid_schemes)

	Meta.allow_tag_with_this_attribute_values(:a, "class", [
	"hashtag",
	"u-url",
	"mention",
	"u-url mention",
	"mention u-url"
	])

	Meta.allow_tag_with_this_attribute_values(:a, "rel", [
	"tag",
	"nofollow",
	"noopener",
	"noreferrer"
	])

	Meta.allow_tag_with_these_attributes(:a, ["name", "title"])

	# paragraphs and linebreaks
	Meta.allow_tag_with_these_attributes(:br, [])
	Meta.allow_tag_with_these_attributes(:p, [])

	# microformats
	Meta.allow_tag_with_this_attribute_values(:span, "class", ["h-card"])
	Meta.allow_tag_with_these_attributes(:span, [])

	# allow inline images for custom emoji
	if Pleroma.Config.get([:markup, :allow_inline_images]) do
	+ Meta.allow_tag_with_this_attribute_values(:img, "class", ["emoji"])
	+
	# restrict img tags to http/https only, because of MediaProxy.
	Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])

	Meta.allow_tag_with_these_attributes(:img, [
	"width",
	"height",
	- "class",
	"title",
	"alt"
	])
	end

	Meta.strip_everything_not_covered()
	end
	diff --git a/test/pleroma/html_test.exs b/test/pleroma/html_test.exs
	index fe1a1ed57..a1e4bf457 100644
	--- a/test/pleroma/html_test.exs
	+++ b/test/pleroma/html_test.exs
	@@ -1,255 +1,281 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.HTMLTest do
	alias Pleroma.HTML
	alias Pleroma.Object
	alias Pleroma.Web.CommonAPI
	use Pleroma.DataCase, async: true

	import Pleroma.Factory

	@html_sample """
	<b>this is in bold</b>
	<p>this is a paragraph</p>
	this is a linebreak<br />
	this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
	this is a link with not allowed "rel" attribute: <a href="http://example.com/" rel="tag noallowed">example.com</a>
	this is an image: <img src="http://example.com/image.jpg"><br />
	+ this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"><br />
	<script>alert('hacked')</script>
	"""

	@html_onerror_sample """
	<img src="http://example.com/image.jpg" onerror="alert('hacked')">
	"""

	+ @html_stillimage_sample """
	+ <img class="still-image" src="http://example.com/image.jpg">
	+ """
	+
	@html_span_class_sample """
	<span class="animate-spin">hi</span>
	"""

	@html_span_microformats_sample """
	<span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
	"""

	@html_span_invalid_microformats_sample """
	<span class="h-card"><a class="u-url mention animate-spin">@<span>foo</span></a></span>
	"""

	describe "StripTags scrubber" do
	test "works as expected" do
	expected = """
	this is in bold
	this is a paragraph
	this is a linebreak
	this is a link with allowed "rel" attribute: example.com
	this is a link with not allowed "rel" attribute: example.com
	this is an image:
	+ this is an inline emoji:
	alert('hacked')
	"""

	assert expected == HTML.strip_tags(@html_sample)
	end

	test "does not allow attribute-based XSS" do
	expected = "\n"

	assert expected == HTML.strip_tags(@html_onerror_sample)
	end
	end

	describe "TwitterText scrubber" do
	test "normalizes HTML as expected" do
	expected = """
	this is in bold
	<p>this is a paragraph</p>
	this is a linebreak<br/>
	this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
	this is a link with not allowed "rel" attribute: <a href="http://example.com/">example.com</a>
	this is an image: <img src="http://example.com/image.jpg"/><br/>
	+ this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"/><br/>
	alert('hacked')
	"""

	assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "does not allow attribute-based XSS" do
	expected = """
	<img src="http://example.com/image.jpg"/>
	"""

	assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "does not allow spans with invalid classes" do
	expected = """
	<span>hi</span>
	"""

	assert expected ==
	HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	+ test "does not allow images with invalid classes" do
	+ expected = """
	+ <img src="http://example.com/image.jpg"/>
	+ """
	+
	+ assert expected ==
	+ HTML.filter_tags(@html_stillimage_sample, Pleroma.HTML.Scrubber.TwitterText)
	+ end
	+
	test "does allow microformats" do
	expected = """
	<span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
	"""

	assert expected ==
	HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "filters invalid microformats markup" do
	expected = """
	<span class="h-card"><a>@<span>foo</span></a></span>
	"""

	assert expected ==
	HTML.filter_tags(
	@html_span_invalid_microformats_sample,
	Pleroma.HTML.Scrubber.TwitterText
	)
	end
	end

	describe "default scrubber" do
	test "normalizes HTML as expected" do
	expected = """
	<b>this is in bold</b>
	<p>this is a paragraph</p>
	this is a linebreak<br/>
	this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
	this is a link with not allowed "rel" attribute: <a href="http://example.com/">example.com</a>
	this is an image: <img src="http://example.com/image.jpg"/><br/>
	+ this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"/><br/>
	alert('hacked')
	"""

	assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.Default)
	end

	test "does not allow attribute-based XSS" do
	expected = """
	<img src="http://example.com/image.jpg"/>
	"""

	assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.Default)
	end

	test "does not allow spans with invalid classes" do
	expected = """
	<span>hi</span>
	"""

	assert expected == HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.Default)
	end

	+ test "does not allow images with invalid classes" do
	+ expected = """
	+ <img src="http://example.com/image.jpg"/>
	+ """
	+
	+ assert expected ==
	+ HTML.filter_tags(@html_stillimage_sample, Pleroma.HTML.Scrubber.TwitterText)
	+ end
	+
	test "does allow microformats" do
	expected = """
	<span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
	"""

	assert expected ==
	HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.Default)
	end

	test "filters invalid microformats markup" do
	expected = """
	<span class="h-card"><a>@<span>foo</span></a></span>
	"""

	assert expected ==
	HTML.filter_tags(
	@html_span_invalid_microformats_sample,
	Pleroma.HTML.Scrubber.Default
	)
	end
	end

	describe "extract_first_external_url_from_object" do
	test "extracts the url" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"I think I just found the best github repo https://github.com/komeiji-satori/Dress"
	})

	object = Object.normalize(activity, fetch: false)
	{:ok, url} = HTML.extract_first_external_url_from_object(object)
	assert url == "https://github.com/komeiji-satori/Dress"
	end

	test "skips mentions" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"@#{other_user.nickname} install misskey! https://github.com/syuilo/misskey/blob/develop/docs/setup.en.md"
	})

	object = Object.normalize(activity, fetch: false)
	{:ok, url} = HTML.extract_first_external_url_from_object(object)

	assert url == "https://github.com/syuilo/misskey/blob/develop/docs/setup.en.md"

	refute url == other_user.ap_id
	end

	test "skips hashtags" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "#cofe https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
	})

	object = Object.normalize(activity, fetch: false)
	{:ok, url} = HTML.extract_first_external_url_from_object(object)

	assert url == "https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
	end

	test "skips microformats hashtags" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"<a href=\"https://pleroma.gov/tags/cofe\" rel=\"tag\">#cofe</a> https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140",
	content_type: "text/html"
	})

	object = Object.normalize(activity, fetch: false)
	{:ok, url} = HTML.extract_first_external_url_from_object(object)

	assert url == "https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
	end

	test "does not crash when there is an HTML entity in a link" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "\"http://cofe.com/?boomer=ok&foo=bar\""})

	object = Object.normalize(activity, fetch: false)

	assert {:ok, nil} = HTML.extract_first_external_url_from_object(object)
	end

	test "skips attachment links" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"<a href=\"https://pleroma.gov/media/d24caa3a498e21e0298377a9ca0149a4f4f8b767178aacf837542282e2d94fb1.png?name=image.png\" class=\"attachment\">image.png</a>"
	})

	object = Object.normalize(activity, fetch: false)

	assert {:ok, nil} = HTML.extract_first_external_url_from_object(object)
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Fri, Aug 28, 1:00 PM (9 h, 6 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1736419
Default Alt Text: (14 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions