Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: disallow more characters in links #5509

Merged
merged 3 commits into from
Jul 20, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
- Bugfix: Fixed user info card popups adding duplicate line to log files. (#5499)
- Bugfix: Fixed `/clearmessages` not working with more than one window. (#5489)
- Bugfix: Fixed splits staying paused after unfocusing Chatterino in certain configurations. (#5504)
- Bugfix: Links with invalid characters in the domain are no longer detected. (#5509)
- Dev: Update Windows build from Qt 6.5.0 to Qt 6.7.1. (#5420)
- Dev: Update vcpkg build Qt from 6.5.0 to 6.7.0, boost from 1.83.0 to 1.85.0, openssl from 3.1.3 to 3.3.0. (#5422)
- Dev: Unsingletonize `ISoundController`. (#5462)
Expand Down
15 changes: 15 additions & 0 deletions src/common/LinkParser.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,16 @@ void strip(QStringView &source)
}
}

/// @brief Checks if @a c is valid in a domain
///
/// Valid characters are 0-9, A-Z, a-z, '-', '_', and '.' (like in GFM)
/// and all non-ASCII characters (unlike in GFM).
Q_ALWAYS_INLINE bool isValidDomainChar(char16_t c)
{
return c >= 0x80 || (u'0' <= c && c <= u'9') || (u'A' <= c && c <= u'Z') ||
(u'a' <= c && c <= u'z') || c == u'_' || c == u'-' || c == u'.';
}

} // namespace

namespace chatterino::linkparser {
Expand Down Expand Up @@ -233,6 +243,11 @@ std::optional<Parsed> parse(const QString &source) noexcept
rest = remaining.mid(i);
break;
}

if (!isValidDomainChar(currentChar))
{
return result;
}
}

if (lastWasDot || lastDotPos <= 0)
Expand Down
32 changes: 27 additions & 5 deletions tests/src/LinkParser.cpp
Original file line number Diff line number Diff line change
@@ -1,11 +1,13 @@
#include "common/LinkParser.hpp"

#include "common/Literals.hpp"
#include "Test.hpp"

#include <QString>
#include <QStringList>

using namespace chatterino;
using namespace literals;

struct Case {
// -Wmissing-field-initializers complains otherwise
Expand Down Expand Up @@ -91,6 +93,14 @@ TEST(LinkParser, parseDomainLinks)
{"", "a.com", "?("},
{"", "a.com", "#("},
{"", "a.com", "/__my_user__"},
{"", "a.b.c.-._.1.com", ""},
{"", "0123456789.com", ""},
{"", "ABCDEFGHIJKLMNOPQRSTUVWXYZ.com", ""},
{"", "abcdefghijklmnopqrstuvwxyz.com", ""},
// non-ASCII characters are allowed
{"", u"köln.de"_s, ""},
{"", u"ü.com"_s, ""},
{"", u"─.com"_s, ""},
// test case-insensitiveness
{"HtTpS://", "127.0.0.1.CoM"},
{"HTTP://", "XD.CHATTERINO.COM", "/#?FOO"},
Expand Down Expand Up @@ -168,6 +178,7 @@ TEST(LinkParser, doesntParseInvalidIpv4Links)
"196.162.8.1(())",
"196.162.8.1(",
"196.162.8.1(!",
"127.1.1;.com",
};

for (const auto &input : inputs)
Expand Down Expand Up @@ -219,11 +230,22 @@ TEST(LinkParser, doesntParseInvalidLinks)
"~~a.com()",
"https://chatterino.com><https://chatterino.com",
"<https://chatterino.com><https://chatterino.com>",
// invalid characters are still accepted (see #4769)
// "chatterino.com><chatterino.com",
// "https://chatterino.com><chatterino.com",
// "<chatterino.com><chatterino.com>",
// "<https://chatterino.com><chatterino.com>",
"chatterino.com><chatterino.com",
"https://chatterino.com><chatterino.com",
"<chatterino.com><chatterino.com>",
"<https://chatterino.com><chatterino.com>",
"info@example.com",
"user:pass@example.com",
":.com",
"a:.com",
"1:.com",
"[a].com",
"`a`.com",
"{a}.com",
"a.com:pass@example.com",
"@@@.com",
"%%%.com",
"*.com",
};

for (const auto &input : inputs)
Expand Down
Loading