imterah/element-portable
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wrap decodeURIComponent in try-catch to protect against malformed URIs

Browse source
This commit is contained in:
Michael Telatynski 2021-05-13 10:20:27 +01:00
parent 52420feab0
commit dd04b479a1
2 changed files with 17 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/linkify-matrix.js
View file

@ -254,12 +254,16 @@ matrixLinkify.options = {
target: function(href, type) { target: function(href, type) {
if (type === 'url') { if (type === 'url') {
try {
const transformed = tryTransformPermalinkToLocalHref(href); const transformed = tryTransformPermalinkToLocalHref(href);
if (transformed !== href || decodeURIComponent(href).match(matrixLinkify.ELEMENT_URL_PATTERN)) { if (transformed !== href || decodeURIComponent(href).match(matrixLinkify.ELEMENT_URL_PATTERN)) {
return null; return null;
} else { } else {
return '_blank'; return '_blank';
} }
} catch (e) {
// malformed URI
}
} }
return null; return null;
}, },

5
src/utils/permalinks/Permalinks.ts
View file

@ -346,10 +346,15 @@ export function tryTransformPermalinkToLocalHref(permalink: string): string {
return permalink; return permalink;
} }
try {
const m = decodeURIComponent(permalink).match(matrixLinkify.ELEMENT_URL_PATTERN); const m = decodeURIComponent(permalink).match(matrixLinkify.ELEMENT_URL_PATTERN);
if (m) { if (m) {
return m[1]; return m[1];
} }
} catch (e) {
// Not a valid URI
return permalink;
}
// A bit of a hack to convert permalinks of unknown origin to Element links // A bit of a hack to convert permalinks of unknown origin to Element links
try { try {