Skip to content

Commit

Permalink
WebClient: improve HTML escaping
Browse files Browse the repository at this point in the history 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
  • Loading branch information
@drakkan
drakkan committed Sep 12, 2022
1 parent 4a34ae6 commit cbef217
Show file tree
Hide file tree
Showing 5 changed files with 65 additions and 32 deletions.
15 changes: 14 additions & 1 deletion templates/webadmin/base.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -265,8 +265,21 @@ <h5 class="modal-title" id="modalLabel">Ready to Leave?</h5>
<script src="{{.StaticURL}}/js/sb-admin-2.min.js"></script>

<script type="text/javascript">
function escapeHTML(str) {
var div = document.createElement('div');
div.appendChild(document.createTextNode(str));
return div.innerHTML;
}

function unescapeHTML(escapedStr) {
var div = document.createElement('div');
div.innerHTML = escapedStr;
var child = div.childNodes[0];
return child ? child.nodeValue : '';
}

function fixedEncodeURIComponent(str) {
return encodeURIComponent(str).replace(/[!'()*]/g, function (c) {
return encodeURIComponent(unescapeHTML(str)).replace(/[!'()*]/g, function (c) {
return '%' + c.charCodeAt(0).toString(16);
});
}
Expand Down
38 changes: 30 additions & 8 deletions templates/webclient/base.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -219,8 +219,30 @@ <h5 class="modal-title" id="modalLabel">Ready to Leave?</h5>
<script src="{{.StaticURL}}/js/sb-admin-2.min.js"></script>

<script type="text/javascript">
function escapeHTML(str) {
var div = document.createElement('div');
div.appendChild(document.createTextNode(str));
return div.innerHTML;
}

function unescapeHTML(escapedStr) {
var div = document.createElement('div');
div.innerHTML = escapedStr;
var child = div.childNodes[0];
return child ? child.nodeValue : '';
}

function escapeHTMLForceSafe(str) {
return str
.replace(/&/g, '_')
.replace(/</g, '_')
.replace(/>/g, '_')
.replace(/\"/g, '_')
.replace(/\'/g, '_');
}

function fixedEncodeURIComponent(str) {
return encodeURIComponent(str).replace(/[!'()*]/g, function (c) {
return encodeURIComponent(unescapeHTML(str)).replace(/[!'()*]/g, function (c) {
return '%' + c.charCodeAt(0).toString(16);
});
}
Expand All @@ -229,13 +251,13 @@ <h5 class="modal-title" id="modalLabel">Ready to Leave?</h5>
return str.replace(/\//g,'\u2215');
}

var escapeHTML = function ( t ) {
return t
.replace( /&/g, '&amp;' )
.replace( /</g, '&lt;' )
.replace( />/g, '&gt;' )
.replace( /"/g, '&quot;' );
};
function b64EncodeUnicode(str) {
return btoa(encodeURIComponent(str));
}

function UnicodeDecodeB64(str) {
return decodeURIComponent(atob(str));
}
</script>

<!-- Page level plugins -->
Expand Down
26 changes: 16 additions & 10 deletions templates/webclient/files.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,7 @@ <h5 class="modal-title" id="videoModalLabel">
if (childReference == null || childReference.closed) {
childProps.set('link', fileLink);
childProps.set('url', url);
childProps.set('file_name', fileName);
childProps.set('file_name', UnicodeDecodeB64(fileName));
childReference = window.open(url, '_blank');
if (!checkerStarted){
keepAlive();
Expand Down Expand Up @@ -366,7 +366,7 @@ <h5 class="modal-title" id="videoModalLabel">

async function saveBlob() {
var errorMessage = "Error saving external file";
var uploadPath = '{{.FileURL}}?path={{.CurrentDir}}'+encodeURIComponent("/"+childProps.get('file_name'));
var uploadPath = '{{.FileURL}}?path={{.CurrentDir}}'+encodeURIComponent("/"+unescapeHTML(childProps.get('file_name')));
let response;
try {
response = await fetch(uploadPath, {
Expand Down Expand Up @@ -447,7 +447,7 @@ <h5 class="modal-title" id="videoModalLabel">
}

function openVideoPlayer(name, url, videoType){
$("#video_title").text(name);
$("#video_title").text(UnicodeDecodeB64(name));
$('#videoModal').modal('show');
player.src({
type: videoType,
Expand Down Expand Up @@ -995,8 +995,9 @@ <h5 class="modal-title" id="videoModalLabel">
var title = "";
var cssClass = "";
var shortened = shortenData(data, 70);
data = escapeHTML(data);
if (shortened != data){
title = escapeHTML(data);
title = data;
cssClass = "ellipsis";
}

Expand All @@ -1017,7 +1018,7 @@ <h5 class="modal-title" id="videoModalLabel">
{ "data": "edit_url",
"render": function (data, type, row) {
if (type === 'display') {
var filename = row["name"];
var filename = escapeHTML(row["name"]);
var extension = filename.slice((filename.lastIndexOf(".") - 1 >>> 0) + 2).toLowerCase();
if (data){
if (extension == "csv" || extension == "bat" || CodeMirror.findModeByExtension(extension) != null){
Expand All @@ -1039,15 +1040,19 @@ <h5 class="modal-title" id="videoModalLabel">
case "svg":
case "ico":
var view_url = row['url']+"&inline=1";
return `<a href="${view_url}" data-lightbox="image-gallery" data-title="${filename}"><i class="fas fa-eye"></i></a>`;
var title = escapeHTMLForceSafe(row["name"])
return `<a href="${view_url}" data-lightbox="image-gallery" data-title="${title}"><i class="fas fa-eye"></i></a>`;
case "mp4":
case "mov":
return `<a href="#" onclick="openVideoPlayer('${row["name"]}', '${row['url']}', 'video/mp4');"><i class="fas fa-eye"></i></a>`;
var name = b64EncodeUnicode(row["name"]);
return `<a href="#" onclick="openVideoPlayer('${name}', '${row['url']}', 'video/mp4');"><i class="fas fa-eye"></i></a>`;
case "webm":
return `<a href="#" onclick="openVideoPlayer('${row["name"]}', '${row['url']}', 'video/webm');"><i class="fas fa-eye"></i></a>`;
var name = b64EncodeUnicode(row["name"]);
return `<a href="#" onclick="openVideoPlayer('${name}', '${row['url']}', 'video/webm');"><i class="fas fa-eye"></i></a>`;
case "ogv":
case "ogg":
return `<a href="#" onclick="openVideoPlayer('${row["name"]}', '${row['url']}', 'video/ogg');"><i class="fas fa-eye"></i></a>`;
var name = b64EncodeUnicode(row["name"]);
return `<a href="#" onclick="openVideoPlayer('${name}}', '${row['url']}', 'video/ogg');"><i class="fas fa-eye"></i></a>`;
case "pdf":
if (PDFObject.supportsPDFs){
var view_url = row['url'];
Expand All @@ -1065,7 +1070,8 @@ <h5 class="modal-title" id="videoModalLabel">
{{if .HasIntegrations}}
if (type === 'display') {
if (data){
return `<a href="#" onclick="openExternalURL('${data}', '${row["ext_link"]}', '${row["name"]}');"><i class="fas fa-external-link-alt"></i></a>`;
var name = b64EncodeUnicode(escapeHTML(row["name"]));
return `<a href="#" onclick="openExternalURL('${data}', '${row["ext_link"]}', '${name}');"><i class="fas fa-external-link-alt"></i></a>`;
}
}
{{end}}
Expand Down
16 changes: 4 additions & 12 deletions templates/webclient/sharefiles.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -94,26 +94,17 @@ <h5 class="modal-title" id="uploadFilesModalLabel">
<script src="{{.StaticURL}}/vendor/datatables/dataTables.responsive.min.js"></script>
<script src="{{.StaticURL}}/vendor/datatables/responsive.bootstrap4.min.js"></script>
<script type="text/javascript">

var escapeHTML = function ( t ) {
return t
.replace( /&/g, '&amp;' )
.replace( /</g, '&lt;' )
.replace( />/g, '&gt;' )
.replace( /"/g, '&quot;' );
};

function shortenData(d, cutoff) {
if ( typeof d !== 'string' ) {
return d;
}

if ( d.length <= cutoff ) {
return d;
return escapeHTML(d);
}

var shortened = d.substr(0, cutoff-1);
return shortened+'&#8230;';
return escapeHTML(shortened)+'&#8230;';
}

function getIconForFile(filename) {
Expand Down Expand Up @@ -250,7 +241,7 @@ <h5 class="modal-title" id="uploadFilesModalLabel">
let response;
try {
var f = files[index];
var uploadPath = '{{.UploadBaseURL}}'+fixedEncodeURIComponent("/"+f.name);
var uploadPath = '{{.UploadBaseURL}}'+fixedEncodeURIComponent("/"+escapeHTML(f.name));
var lastModified;
try {
lastModified = f.lastModified;
Expand Down Expand Up @@ -384,6 +375,7 @@ <h5 class="modal-title" id="uploadFilesModalLabel">
var title = "";
var cssClass = "";
var shortened = shortenData(data, 70);
data = escapeHTML(data);
if (shortened != data){
title = escapeHTML(data);
cssClass = "ellipsis";
Expand Down
2 changes: 1 addition & 1 deletion templates/webclient/shareupload.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ <h6 id="success_title" class="m-0 font-weight-bold text-primary" style="display:
let response;
try {
var f = files[index];
var uploadPath = '{{.UploadBasePath}}/'+fixedEncodeURIComponent(f.name);
var uploadPath = '{{.UploadBasePath}}/'+fixedEncodeURIComponent(escapeHTML(f.name));
var lastModified;
try {
lastModified = f.lastModified;
Expand Down

0 comments on commit cbef217

Please sign in to comment.