IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

FIX: skip iframe URLs with relative paths in pretty text sanitizer. (#21714)

Browse Source 
This commit prevents unallowed URLs in iframe src by adding a relative path like `https://bob.com/abc/def/../ghi`. Currently, the iframe linking to the site uses the current_user, not the post's author, so users who have no access to a certain path are not able to view anything they shouldn't.
This commit is contained in:
Vinoth Kannan
2023-05-24 16:14:18 +05:30
committed by GitHub
parent 69274cdb88
commit ded6ea66a5
2 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
spec/lib/pretty_text_spec.rb
View File

@@ -2367,6 +2367,21 @@ HTML
expect(cooked).to eq(html.strip)
end
it "can skip relative paths in allowlist iframes" do
SiteSetting.allowed_iframes = "https://bob.com/abc/def"
raw = <<~HTML
<iframe src='https://bob.com/abc/def'></iframe>
<iframe src='https://bob.com/abc/def/../ghi'></iframe>
<iframe src='https://bob.com/abc/def/ghi/../../jkl'></iframe>
HTML
html = <<~HTML
<iframe src="https://bob.com/abc/def"></iframe>
HTML
expect(PrettyText.cook(raw).strip).to eq(html.strip)
end
it "You can disable linkify" do
md = "www.cnn.com test.it http://test.com https://test.ab https://a"
cooked = PrettyText.cook(md)