cebb3e9e44
Images were a broken icon for every user. The stored URL was bound straight to <img src>, and a plain image request carries no Authorization header while this app keeps its JWT in one, so every fetch was a 401. They are now fetched through the API client, which also fixes the stored '/api/...' path under a subpath mount where the API is not at /api at all. A failed image says so in words rather than rendering as a broken icon, and the editor's own thumbnails go through the same path - an author needs to see the screenshot they pasted. Revision and image routes gated on their parent guide. Both were gated on guides.view alone, and revision ids are sequential, so being able to read one guide was enough to walk the ids and read every unpublished draft on the site - the opposite of what docs/GUIDES.md promises. An image in a PUBLISHED guide still serves to any reader; one that only appears in a draft does not. The guide list, the tag chips and search now match the PUBLISHED text rather than the working copy. Matching the working copy handed readers a hit on wording that is not in the page when they open it. The slug no longer follows the title. It was regenerated on every save that carried a title and the editor autosaves every three seconds, so fixing a typo in a heading silently moved the URL and broke exactly the pasted links the stored slug exists to protect. publish() now aborts when the pre-publish save failed. It ran regardless, so the author saw "Published version N" while readers got the previous revision. Link rendering: text is escaped before formatting, so a captured URL arrives carrying entities and was escaped a second time - every multi-parameter ServiceNow and SharePoint link opened with &amp; in it. Emphasis could also reach inside an href, and '//host' passed as an in-app link when the browser reads it as off-site. Tests are now HTTP-level. The draft-invisibility rule lived entirely in routes that no test executed, which is how three of them shipped serving drafts.
51 lines
1.9 KiB
JavaScript
51 lines
1.9 KiB
JavaScript
/**
|
|
* Inline rendering: the security model and the link bugs it hid.
|
|
*
|
|
* Escape-then-format is the whole defence, and it has one awkward consequence
|
|
* that produced real broken links: by the time a URL is captured it is already
|
|
* escaped, so it has to be decoded before it can be escaped again exactly once.
|
|
*/
|
|
import { describe, it, expect } from 'vitest'
|
|
import { renderInline } from './inline.js'
|
|
|
|
describe('renderInline', () => {
|
|
it('escapes markup an author pasted', () => {
|
|
expect(renderInline('<img src=x onerror=alert(1)>'))
|
|
.toBe('<img src=x onerror=alert(1)>')
|
|
})
|
|
|
|
it('keeps a multi-parameter URL intact', () => {
|
|
// Double-escaped, this became &amp; and the link opened the wrong
|
|
// record. Every ServiceNow and SharePoint link carries several parameters.
|
|
const html = renderInline('[ticket](https://x.example/nav?a=1&b=2&c=3)')
|
|
expect(html).toContain('href="https://x.example/nav?a=1&b=2&c=3"')
|
|
expect(html).not.toContain('&amp;')
|
|
})
|
|
|
|
it('does not let emphasis reach inside an href', () => {
|
|
const html = renderInline('[t](https://x.example/a*b*c)')
|
|
expect(html).toContain('href="https://x.example/a*b*c"')
|
|
expect(html).not.toContain('<em>')
|
|
})
|
|
|
|
it('refuses a protocol-relative URL dressed as an in-app path', () => {
|
|
// '//evil.example' starts with '/' but the browser reads it as off-site.
|
|
expect(renderInline('[evil](//evil.example/x)')).toBe('evil')
|
|
})
|
|
|
|
it('refuses javascript: and keeps the label', () => {
|
|
expect(renderInline('[bad](javascript:alert(1))')).toBe('bad')
|
|
})
|
|
|
|
it('allows an in-app link', () => {
|
|
expect(renderInline('[map](/map)')).toBe('<a href="/map">map</a>')
|
|
})
|
|
|
|
it('still renders bold, italic and code', () => {
|
|
expect(renderInline('**b**')).toBe('<strong>b</strong>')
|
|
expect(renderInline('*i*')).toBe('<em>i</em>')
|
|
expect(renderInline('`C:\\**temp**`'))
|
|
.toBe('<code>C:\\**temp**</code>')
|
|
})
|
|
})
|