From 545095b3ce312b42ba304d0bb2c76727826e27b4 Mon Sep 17 00:00:00 2001 From: puckipedia Date: Wed, 3 Jan 2018 03:54:08 +0100 Subject: [PATCH] [!] Sanitize incoming classlist properly (#6162) * Sanitize classlist properly * Actually properly sanitize every class after the first * Improve Formatter spec to check for multiple classes and non-space whitespace --- app/lib/sanitize_config.rb | 8 ++++---- spec/lib/formatter_spec.rb | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/app/lib/sanitize_config.rb b/app/lib/sanitize_config.rb index f09288fcdc9..c2b4669245a 100644 --- a/app/lib/sanitize_config.rb +++ b/app/lib/sanitize_config.rb @@ -6,14 +6,14 @@ class Sanitize CLASS_WHITELIST_TRANSFORMER = lambda do |env| node = env[:node] - class_list = node['class']&.split(' ') + class_list = node['class']&.split(/[\t\n\f\r ]/) return unless class_list class_list.keep_if do |e| - return true if e =~ /^(h|p|u|dt|e)-/ # microformats classes - return true if e =~ /^(mention|hashtag)$/ # semantic classes - return true if e =~ /^(ellipsis|invisible)$/ # link formatting classes + next true if e =~ /^(h|p|u|dt|e)-/ # microformats classes + next true if e =~ /^(mention|hashtag)$/ # semantic classes + next true if e =~ /^(ellipsis|invisible)$/ # link formatting classes end node['class'] = class_list.join(' ') diff --git a/spec/lib/formatter_spec.rb b/spec/lib/formatter_spec.rb index 71b6b78d2f6..e79be3645ce 100644 --- a/spec/lib/formatter_spec.rb +++ b/spec/lib/formatter_spec.rb @@ -332,7 +332,7 @@ RSpec.describe Formatter do end context 'contains malicious classes' do - let(:text) { 'Show more' } + let(:text) { 'Show more' } it 'strips malicious classes' do is_expected.to_not include 'status__content__spoiler-link'