github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2024-12-22 23:32:14 +00:00
Code Issues Projects Releases Packages Wiki Activity

fix: Solve codeql security issues

Browse source 
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
This commit is contained in:
Tilman Vatteroth 2022-11-09 22:07:41 +01:00
parent 711b520421
commit 7f6da650d1
9 changed files with 17 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/components/render-page/window-post-message-communicator/window-post-message-communicator.ts
View file

@ -151,6 +151,9 @@ export abstract class WindowPostMessageCommunicator<
* @return {@link true} if the event was processed.
*/
protected handleEvent(event: MessageEvent<MessagePayloadWithUuid<RECEIVE_TYPE>>): void {
if (event.origin !== this.targetOrigin) {
return
}
Optional.ofNullable(event.data)
.filter((value) => value.uuid === this.uuid)
.ifPresent((payload) => {

7
src/extensions/extra-integrations/gist/replace-gist-link.ts
View file

@ -7,12 +7,7 @@
import { GistMarkdownExtension } from './gist-markdown-extension'
import type { RegexOptions } from '../../../external-types/markdown-it-regex/interface'
const protocolRegex = /(?:http(?:s)?:\/\/)?/
const domainRegex = /(?:gist\.github\.com\/)/
const idRegex = /(\w+\/\w+)/
const tailRegex = /(?:[./?#].*)?/
const gistUrlRegex = new RegExp(`(?:${protocolRegex.source}${domainRegex.source}${idRegex.source}${tailRegex.source})`)
const linkRegex = new RegExp(`^${gistUrlRegex.source}$`, 'i')
const linkRegex = /^(?:https?:\/\/)?gist\.github\.com\/(\w+\/\w+)(?:[./?#].*)?$/i
/**
* Replacer for gist links.

4
src/extensions/extra-integrations/vimeo/__snapshots__/vimeo-frame.test.tsx.snap
View file

@ -10,8 +10,8 @@ exports[`VimeoFrame renders a click shield 1`] = `
<iframe
allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture"
class="embed-responsive-item"
src="https://player.vimeo.com/video/valid vimeo id?autoplay=1"
title="vimeo video of valid vimeo id"
src="https://player.vimeo.com/video/validVimeoId?autoplay=1"
title="vimeo video of validVimeoId"
/>
</span>
</span>

10
src/extensions/extra-integrations/vimeo/replace-vimeo-link.ts
View file

@ -9,14 +9,8 @@ import type MarkdownIt from 'markdown-it'
import markdownItRegex from 'markdown-it-regex'
import type { RegexOptions } from '../../../external-types/markdown-it-regex/interface'
const protocolRegex = /(?:http(?:s)?:\/\/)?/
const domainRegex = /(?:player\.)?(?:vimeo\.com\/)(?:(?:channels|album|ondemand|groups)\/\w+\/)?(?:video\/)?/
const idRegex = /(\d{6,11})/
const tailRegex = /(?:[?#].*)?/
const vimeoVideoUrlRegex = new RegExp(
`(?:${protocolRegex.source}${domainRegex.source}${idRegex.source}${tailRegex.source})`
)
const linkRegex = new RegExp(`^${vimeoVideoUrlRegex.source}$`, 'i')
const linkRegex =
/^(?:https?:\/\/)?(?:player\.)?vimeo\.com\/(?:(?:channels|album|ondemand|groups)\/\w+\/)?(?:video\/)?(\d{6,11})(?:[?#].*)?$/i
const replaceVimeoLink: RegexOptions = {
name: 'vimeo-link',

2
src/extensions/extra-integrations/vimeo/vimeo-frame.test.tsx
View file

@ -19,7 +19,7 @@ describe('VimeoFrame', () => {
})
it('renders a click shield', () => {
const view = render(<VimeoFrame id={'valid vimeo id'} />)
const view = render(<VimeoFrame id={'validVimeoId'} />)
expect(view.container).toMatchSnapshot()
})
})

4
src/extensions/extra-integrations/youtube/__snapshots__/youtube-frame.test.tsx.snap
View file

@ -10,8 +10,8 @@ exports[`YoutubeFrame renders a click shield 1`] = `
<iframe
allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture"
class="embed-responsive-item"
src="https://www.youtube-nocookie.com/embed/valid youtube id?autoplay=1"
title="youtube video of valid youtube id"
src="https://www.youtube-nocookie.com/embed/validYoutubeId?autoplay=1"
title="youtube video of validYoutubeId"
/>
</span>
</span>

6
src/extensions/extra-integrations/youtube/replace-youtube-link.test.ts
View file

@ -34,17 +34,17 @@ describe('Replace youtube link', () => {
})
it("won't detect an invalid(too short) youtube id", () => {
const invalidUrl = '${origin}?v=1'
const invalidUrl = `${origin}?v=1`
expect(markdownIt.renderInline(invalidUrl)).toBe(invalidUrl)
})
it("won't detect an invalid(invalid characters) youtube id", () => {
const invalidUrl = '${origin}?v= /!#/'
const invalidUrl = `${origin}?v= /!#/`
expect(markdownIt.renderInline(invalidUrl)).toBe(invalidUrl)
})
it("won't detect an invalid(too long) youtube id", () => {
const invalidUrl = '${origin}?v=111111111111111111111111111111111'
const invalidUrl = `${origin}?v=111111111111111111111111111111111`
expect(markdownIt.renderInline(invalidUrl)).toBe(invalidUrl)
})
})

11
src/extensions/extra-integrations/youtube/replace-youtube-link.ts
View file

@ -9,15 +9,8 @@ import markdownItRegex from 'markdown-it-regex'
import type MarkdownIt from 'markdown-it'
import type { RegexOptions } from '../../../external-types/markdown-it-regex/interface'
const protocolRegex = /(?:http(?:s)?:\/\/)?/
const subdomainRegex = /(?:www.)?/
const pathRegex = /(?:youtube(?:-nocookie)?\.com\/(?:[^\\/]+\/.+\/|(?:v|e(?:mbed)?)\/|.*[?&]v=)|youtu\.be\/)/
const idRegex = /([\w-]{11})/
const tailRegex = /(?:[?&#].*)?/
const youtubeVideoUrlRegex = new RegExp(
`(?:${protocolRegex.source}${subdomainRegex.source}${pathRegex.source}${idRegex.source}${tailRegex.source})`
)
const linkRegex = new RegExp(`^${youtubeVideoUrlRegex.source}$`, 'i')
const linkRegex =
/^(?:https?:\/\/)?(?:www.)?(?:youtube(?:-nocookie)?\.com\/(?:[^\\/]+\/.+\/|(?:v|e(?:mbed)?)\/|.*[?&]v=)|youtu\.be\/)([\w-]{11})(?:[?&#].*)?$/i
/**
* Replacer for youtube links.

2
src/extensions/extra-integrations/youtube/youtube-frame.test.tsx
View file

@ -19,7 +19,7 @@ describe('YoutubeFrame', () => {
})
it('renders a click shield', () => {
const view = render(<YouTubeFrame id={'valid youtube id'} />)
const view = render(<YouTubeFrame id={'validYoutubeId'} />)
expect(view.container).toMatchSnapshot()
})
})