Skip to content

Commit

Permalink
Improve url validation inside message object (#15074)
Browse files Browse the repository at this point in the history
  • Loading branch information
@MarcosSpessatto @d-gubert
MarcosSpessatto authored and d-gubert committed Aug 6, 2019
1 parent b9a9a3f commit 926f629
Show file tree
Hide file tree
Showing 2 changed files with 216 additions and 12 deletions.
29 changes: 17 additions & 12 deletions app/lib/server/functions/sendMessage.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import { callbacks } from '../../../callbacks';
import { Messages } from '../../../models';
import { Apps } from '../../../apps/server';
import { Markdown } from '../../../markdown/server';
import { isURL } from '../../../utils/lib/isURL';

/**
* IMPORTANT
Expand All @@ -16,9 +17,13 @@ import { Markdown } from '../../../markdown/server';
* is going to be rendered in the href attribute of a
* link.
*/
const ValidHref = Match.Where((value) => {
const ValidLinkParam = Match.Where((value) => {
check(value, String);

if (!isURL(value)) {
throw new Error('Invalid href value provided');
}

if (/^javascript:/i.test(value)) {
throw new Error('Invalid href value provided');
}
Expand Down Expand Up @@ -57,8 +62,8 @@ const validateAttachmentsActions = (attachmentActions) => {
check(attachmentActions, objectMaybeIncluding({
type: String,
text: String,
url: ValidHref,
image_url: String,
url: ValidLinkParam,
image_url: ValidLinkParam,
is_webview: Boolean,
webview_height_ratio: String,
msg: String,
Expand All @@ -71,26 +76,26 @@ const validateAttachment = (attachment) => {
color: String,
text: String,
ts: Match.OneOf(String, Match.Integer),
thumb_url: String,
thumb_url: ValidLinkParam,
button_alignment: String,
actions: [Match.Any],
message_link: ValidHref,
message_link: ValidLinkParam,
collapsed: Boolean,
author_name: String,
author_link: ValidHref,
author_icon: String,
author_link: ValidLinkParam,
author_icon: ValidLinkParam,
title: String,
title_link: ValidHref,
title_link: ValidLinkParam,
title_link_download: Boolean,
image_dimensions: Object,
image_url: String,
image_url: ValidLinkParam,
image_preview: String,
image_type: String,
image_size: Number,
audio_url: String,
audio_url: ValidLinkParam,
audio_type: String,
audio_size: Number,
video_url: String,
video_url: ValidLinkParam,
video_type: String,
video_size: Number,
fields: [Match.Any],
Expand All @@ -114,7 +119,7 @@ const validateMessage = (message) => {
text: String,
alias: String,
emoji: String,
avatar: String,
avatar: ValidLinkParam,
attachments: [Match.Any],
}));

Expand Down
199 changes: 199 additions & 0 deletions tests/end-to-end/api/05-chat.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,205 @@ describe('[Chat]', function() {
})
.end(done)
);

it('message.avatar', (done) =>
request.post(api('chat.postMessage'))
.set(credentials)
.send({
channel: 'general',
text: 'Sample message',
alias: 'Gruggy',
emoji: ':smirk:',
avatar: 'javascript:alert("xss")',
attachments: [{
color: '#ff0000',
text: 'Yay for gruggy!',
ts: '2016-12-09T16:53:06.761Z',
title: 'Attachment Example',
title_link: 'https://youtube.com',
actions: [
{
type: 'button',
text: 'Text',
url: 'https://youtube.com',
},
],
}],
})
.expect('Content-Type', 'application/json')
.expect(400)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
})
.end(done)
);

it('attachment.action.image_url', (done) =>
request.post(api('chat.postMessage'))
.set(credentials)
.send({
channel: 'general',
text: 'Sample message',
alias: 'Gruggy',
emoji: ':smirk:',
avatar: 'http://res.guggy.com/logo_128.png',
attachments: [{
color: '#ff0000',
text: 'Yay for gruggy!',
ts: '2016-12-09T16:53:06.761Z',
title: 'Attachment Example',
title_link: 'https://youtube.com',
actions: [
{
type: 'button',
text: 'Text',
url: 'http://res.guggy.com/logo_128.png',
image_url: 'javascript:alert("xss")',
},
],
}],
})
.expect('Content-Type', 'application/json')
.expect(400)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
})
.end(done)
);

it('attachment.thumb_url', (done) =>
request.post(api('chat.postMessage'))
.set(credentials)
.send({
channel: 'general',
text: 'Sample message',
alias: 'Gruggy',
emoji: ':smirk:',
avatar: 'http://res.guggy.com/logo_128.png',
attachments: [{
color: '#ff0000',
text: 'Yay for gruggy!',
ts: '2016-12-09T16:53:06.761Z',
title: 'Attachment Example',
thumb_url: 'javascript:alert("xss")',
title_link: 'http://res.guggy.com/logo_128.png',
}],
})
.expect('Content-Type', 'application/json')
.expect(400)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
})
.end(done)
);

it('attachment.author_icon', (done) =>
request.post(api('chat.postMessage'))
.set(credentials)
.send({
channel: 'general',
text: 'Sample message',
alias: 'Gruggy',
emoji: ':smirk:',
avatar: 'http://res.guggy.com/logo_128.png',
attachments: [{
color: '#ff0000',
text: 'Yay for gruggy!',
ts: '2016-12-09T16:53:06.761Z',
title: 'Attachment Example',
author_icon: 'javascript:alert("xss")',
title_link: 'http://res.guggy.com/logo_128.png',
}],
})
.expect('Content-Type', 'application/json')
.expect(400)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
})
.end(done)
);
it('attachment.image_url', (done) =>
request.post(api('chat.postMessage'))
.set(credentials)
.send({
channel: 'general',
text: 'Sample message',
alias: 'Gruggy',
emoji: ':smirk:',
avatar: 'http://res.guggy.com/logo_128.png',
attachments: [{
color: '#ff0000',
text: 'Yay for gruggy!',
ts: '2016-12-09T16:53:06.761Z',
title: 'Attachment Example',
image_url: 'javascript:alert("xss")',
title_link: 'http://res.guggy.com/logo_128.png',
}],
})
.expect('Content-Type', 'application/json')
.expect(400)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
})
.end(done)
);
it('attachment.audio_url', (done) =>
request.post(api('chat.postMessage'))
.set(credentials)
.send({
channel: 'general',
text: 'Sample message',
alias: 'Gruggy',
emoji: ':smirk:',
avatar: 'http://res.guggy.com/logo_128.png',
attachments: [{
color: '#ff0000',
text: 'Yay for gruggy!',
ts: '2016-12-09T16:53:06.761Z',
title: 'Attachment Example',
audio_url: 'javascript:alert("xss")',
title_link: 'http://res.guggy.com/logo_128.png',
}],
})
.expect('Content-Type', 'application/json')
.expect(400)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
})
.end(done)
);
it('attachment.video_url', (done) =>
request.post(api('chat.postMessage'))
.set(credentials)
.send({
channel: 'general',
text: 'Sample message',
alias: 'Gruggy',
emoji: ':smirk:',
avatar: 'http://res.guggy.com/logo_128.png',
attachments: [{
color: '#ff0000',
text: 'Yay for gruggy!',
ts: '2016-12-09T16:53:06.761Z',
title: 'Attachment Example',
video_url: 'javascript:alert("xss")',
title_link: 'http://res.guggy.com/logo_128.png',
}],
})
.expect('Content-Type', 'application/json')
.expect(400)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
})
.end(done)
);
});

it('should throw an error when the properties (attachments.fields.title, attachments.fields.value) are with the wrong type', (done) => {
Expand Down

0 comments on commit 926f629

Please sign in to comment.