Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(tools-api): pasteConfig.tags now supports a sanitize config #2100

Merged
merged 30 commits into from
Nov 21, 2022
Merged
Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
818da6a
event handlers function added
robonetphy Jul 16, 2022
52467f0
santization config added
robonetphy Jul 16, 2022
86c8e32
integrate with paste event
robonetphy Jul 16, 2022
a5aaa65
lint removed
robonetphy Jul 16, 2022
bbbd34b
Merge branch 'next' into fix/xss-problem
robonetphy Aug 3, 2022
5338890
remove old changes
robonetphy Aug 3, 2022
a9230d1
object based sanitization configuration support
robonetphy Aug 3, 2022
9131354
paste config updated
robonetphy Aug 25, 2022
2bbd6d0
logic updated
robonetphy Aug 25, 2022
26e557d
extract tag name from paste-config
robonetphy Aug 26, 2022
da2b87d
tool tags added
robonetphy Aug 26, 2022
2acfdee
multi tag sanitization added
robonetphy Aug 26, 2022
18684f8
the comments added
robonetphy Aug 26, 2022
cd631ef
lint removed
robonetphy Aug 26, 2022
3e308d4
Merge branch 'next' into fix/xss-problem
robonetphy Nov 7, 2022
a1f092a
Update types/configs/paste-config.d.ts
robonetphy Nov 7, 2022
dd8d6d6
update the changes
robonetphy Nov 7, 2022
36793eb
lint removed\
robonetphy Nov 7, 2022
f2df84b
return empty array by get tags
robonetphy Nov 11, 2022
0dce253
submoduble reset
robonetphy Nov 11, 2022
cecf49b
Update src/components/modules/paste.ts
robonetphy Nov 11, 2022
8aaff27
changelog added
robonetphy Nov 11, 2022
6cc153b
tool comments added
robonetphy Nov 11, 2022
aae5ee2
chore: docs, code comments updated
neSpecc Nov 11, 2022
b9a3969
fix: xss in processDataTransfer
neSpecc Nov 11, 2022
7fa8040
base tests added
neSpecc Nov 17, 2022
aea30fe
test added
neSpecc Nov 21, 2022
a001c01
rm 'only' from test suite
neSpecc Nov 21, 2022
0373eab
rm log
neSpecc Nov 21, 2022
15857b1
reorder test
neSpecc Nov 21, 2022
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions src/components/dom.ts
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ export default class Dom {
*
* @returns {HTMLElement}
*/
public static make(tagName: string, classNames: string|string[] = null, attributes: object = {}): HTMLElement {
public static make(tagName: string, classNames: string | string[] = null, attributes: object = {}): HTMLElement {
const el = document.createElement(tagName);

if (Array.isArray(classNames)) {
Expand Down Expand Up @@ -109,8 +109,8 @@ export default class Dom {
* @param {Element|Element[]|DocumentFragment|Text|Text[]} elements - element or elements list
*/
public static append(
parent: Element|DocumentFragment,
elements: Element|Element[]|DocumentFragment|Text|Text[]
parent: Element | DocumentFragment,
elements: Element | Element[] | DocumentFragment | Text | Text[]
): void {
if (Array.isArray(elements)) {
elements.forEach((el) => parent.appendChild(el));
Expand All @@ -125,7 +125,7 @@ export default class Dom {
* @param {Element} parent - where to append
* @param {Element|Element[]} elements - element or elements list
*/
public static prepend(parent: Element, elements: Element|Element[]): void {
public static prepend(parent: Element, elements: Element | Element[]): void {
if (Array.isArray(elements)) {
elements = elements.reverse();
elements.forEach((el) => parent.prepend(el));
Expand Down Expand Up @@ -168,7 +168,7 @@ export default class Dom {
*
* @returns {Element}
*/
public static find(el: Element|Document = document, selector: string): Element {
public static find(el: Element | Document = document, selector: string): Element {
return el.querySelector(selector);
}

Expand All @@ -192,7 +192,7 @@ export default class Dom {
*
* @returns {NodeList}
*/
public static findAll(el: Element|Document = document, selector: string): NodeList {
public static findAll(el: Element | Document = document, selector: string): NodeList {
return el.querySelectorAll(selector);
}

Expand Down Expand Up @@ -619,7 +619,7 @@ export default class Dom {
* @todo handle case when editor initialized in scrollable popup
* @param el - element to compute offset
*/
public static offset(el): {top: number; left: number; right: number; bottom: number} {
public static offset(el): { top: number; left: number; right: number; bottom: number } {
const rect = el.getBoundingClientRect();
const scrollLeft = window.pageXOffset || document.documentElement.scrollLeft;
const scrollTop = window.pageYOffset || document.documentElement.scrollTop;
Expand Down
70 changes: 53 additions & 17 deletions src/components/modules/paste.ts
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,11 @@ interface TagSubstitute {
*
*/
tool: BlockTool;
/**
* Paste Sanitization configuration
*
*/
sanitizationConfig?: object;
}

/**
Expand Down Expand Up @@ -112,12 +117,12 @@ export default class Paste extends Module {
/**
* Tags` substitutions parameters
*/
private toolsTags: {[tag: string]: TagSubstitute} = {};
private toolsTags: { [tag: string]: TagSubstitute } = {};

/**
* Store tags to substitute by tool name
*/
private tagsByTool: {[tools: string]: string[]} = {};
private tagsByTool: { [tools: string]: string[] } = {};

/** Patterns` substitutions parameters */
private toolsPatterns: PatternSubstitute[] = [];
Expand Down Expand Up @@ -186,7 +191,7 @@ export default class Paste extends Module {
this.insertEditorJSData(JSON.parse(editorJSData));

return;
} catch (e) {} // Do nothing and continue execution as usual if error appears
} catch (e) { } // Do nothing and continue execution as usual if error appears
}

/**
Expand All @@ -195,10 +200,16 @@ export default class Paste extends Module {
if (isDragNDrop && plainData.trim() && htmlData.trim()) {
htmlData = '<p>' + (htmlData.trim() ? htmlData : plainData) + '</p>';
}

/** Add all tags that can be substituted to sanitizer configuration */
const toolsTags = Object.keys(this.toolsTags).reduce((result, tag) => {
result[tag.toLowerCase()] = true;
/**
* Check if sanitizer configuration for this tag is defined.
*/
if (this.toolsTags[tag].sanitizationConfig) {
result[tag.toLowerCase()] = this.toolsTags[tag].sanitizationConfig;
} else {
result[tag.toLowerCase()] = true;
}

return result;
}, {});
Expand Down Expand Up @@ -324,13 +335,31 @@ export default class Paste extends Module {

return;
}

this.toolsTags[tag.toUpperCase()] = {
tool,
};
/** Sanitization configuration is string */
if (_.isString(tag)) {
robonetphy marked this conversation as resolved.
Show resolved Hide resolved
this.toolsTags[tag.toUpperCase()] = {
tool,
};
}
/** Sanitization configuration is object */
if (_.isObject(tag)) {
robonetphy marked this conversation as resolved.
Show resolved Hide resolved
this.toolsTags[Object.keys(tag)[0].toUpperCase()] = {
robonetphy marked this conversation as resolved.
Show resolved Hide resolved
robonetphy marked this conversation as resolved.
Show resolved Hide resolved
tool,
sanitizationConfig: tag[Object.keys(tag)[0]],
};
}
});

this.tagsByTool[tool.name] = tags.map((t) => t.toUpperCase());
this.tagsByTool[tool.name] = tags.map((t) => {
/** Sanitization configuration is string */
if (_.isString(t)) {
return t.toUpperCase();
}
/** Sanitization configuration is object */
if (_.isObject(t)) {
robonetphy marked this conversation as resolved.
Show resolved Hide resolved
return Object.keys(t)[0].toUpperCase();
}
});
}

/**
Expand Down Expand Up @@ -449,7 +478,7 @@ export default class Paste extends Module {
private async processFiles(items: FileList): Promise<void> {
const { BlockManager } = this.Editor;

let dataToInsert: {type: string; event: PasteEvent}[];
let dataToInsert: { type: string; event: PasteEvent }[];

dataToInsert = await Promise.all(
Array
Expand All @@ -473,12 +502,12 @@ export default class Paste extends Module {
*
* @param {File} file - file to process
*/
private async processFile(file: File): Promise<{event: PasteEvent; type: string}> {
private async processFile(file: File): Promise<{ event: PasteEvent; type: string }> {
const extension = _.getFileExtension(file);

const foundConfig = Object
.entries(this.toolsFiles)
.find(([toolName, { mimeTypes, extensions } ]) => {
.find(([toolName, { mimeTypes, extensions }]) => {
const [fileType, fileSubtype] = file.type.split('/');

const foundExt = extensions.find((ext) => ext.toLowerCase() === extension.toLowerCase());
Expand All @@ -495,7 +524,7 @@ export default class Paste extends Module {
return;
}

const [ tool ] = foundConfig;
const [tool] = foundConfig;
const pasteEvent = this.composePasteEvent('file', {
file,
});
Expand Down Expand Up @@ -546,7 +575,14 @@ export default class Paste extends Module {
const { tags } = tool.pasteConfig;

const toolTags = tags.reduce((result, tag) => {
result[tag.toLowerCase()] = {};
/** Sanitization configuration is string */
if (_.isString(tag)) {
result[tag.toLowerCase()] = {};
}
/** Sanitization configuration is object */
if (_.isObject(tag)) {
result[Object.keys(tag)[0].toUpperCase()] = tag[Object.keys(tag)[0]];
robonetphy marked this conversation as resolved.
Show resolved Hide resolved
}

return result;
}, {});
Expand Down Expand Up @@ -576,7 +612,7 @@ export default class Paste extends Module {
* @returns {PasteData[]}
*/
private processPlain(plain: string): PasteData[] {
const { defaultBlock } = this.config as {defaultBlock: string};
const { defaultBlock } = this.config as { defaultBlock: string };

if (!plain) {
return [];
Expand Down Expand Up @@ -681,7 +717,7 @@ export default class Paste extends Module {
*
* @returns {Promise<{event: PasteEvent, tool: string}>}
*/
private async processPattern(text: string): Promise<{event: PasteEvent; tool: string}> {
private async processPattern(text: string): Promise<{ event: PasteEvent; tool: string }> {
const pattern = this.toolsPatterns.find((substitute) => {
const execResult = substitute.pattern.exec(text);

Expand Down