summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobert Speicher <rspeicher@gmail.com>2016-02-23 20:40:31 -0500
committerRobert Speicher <rspeicher@gmail.com>2016-02-23 20:42:03 -0500
commit989946f33717685065812d72e9ed4490fe969104 (patch)
tree871536ec2cbb9d929d5966afd93f514b81f0da65
parent4225fd229f8503c3007e07cbad2ccac319b2547b (diff)
downloadgitlab-ce-989946f33717685065812d72e9ed4490fe969104.tar.gz
Sanitize `vbscript:` linksrs-data-links
Closes https://dev.gitlab.org/gitlab/gitlabhq/issues/2660
-rw-r--r--lib/banzai/filter/sanitization_filter.rb4
-rw-r--r--spec/lib/banzai/filter/sanitization_filter_spec.rb7
2 files changed, 10 insertions, 1 deletions
diff --git a/lib/banzai/filter/sanitization_filter.rb b/lib/banzai/filter/sanitization_filter.rb
index c201ace8d35..abd79b329ae 100644
--- a/lib/banzai/filter/sanitization_filter.rb
+++ b/lib/banzai/filter/sanitization_filter.rb
@@ -7,6 +7,8 @@ module Banzai
#
# Extends HTML::Pipeline::SanitizationFilter with a custom whitelist.
class SanitizationFilter < HTML::Pipeline::SanitizationFilter
+ UNSAFE_PROTOCOLS = %w(javascript :javascript data vbscript).freeze
+
def whitelist
whitelist = super
@@ -62,7 +64,7 @@ module Banzai
return unless node.name == 'a'
return unless node.has_attribute?('href')
- if node['href'].start_with?('javascript', ':javascript', 'data')
+ if node['href'].start_with?(*UNSAFE_PROTOCOLS)
node.remove_attribute('href')
end
end
diff --git a/spec/lib/banzai/filter/sanitization_filter_spec.rb b/spec/lib/banzai/filter/sanitization_filter_spec.rb
index 247f492e6a9..4a7b00c7660 100644
--- a/spec/lib/banzai/filter/sanitization_filter_spec.rb
+++ b/spec/lib/banzai/filter/sanitization_filter_spec.rb
@@ -170,6 +170,13 @@ describe Banzai::Filter::SanitizationFilter, lib: true do
expect(output.to_html).to eq '<a>XSS</a>'
end
+ it 'disallows vbscript links' do
+ input = '<a href="vbscript:alert(document.domain)">XSS</a>'
+ output = filter(input)
+
+ expect(output.to_html).to eq '<a>XSS</a>'
+ end
+
it 'allows non-standard anchor schemes' do
exp = %q{<a href="irc://irc.freenode.net/git">IRC</a>}
act = filter(exp)