Matrix/element-web-Github
1
0
Fork 0
mirror of https://github.com/vector-im/element-web.git synced 2024-11-16 05:04:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6026 from matrix-org/t3chguy/fix/17281

Browse Source 
Wrap decodeURIComponent in try-catch to protect against malformed URIs
This commit is contained in:
Michael Telatynski 2021-05-13 12:45:57 +01:00 committed by GitHub
commit 712bdba09f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/linkify-matrix.js
View File

@ -254,11 +254,15 @@ matrixLinkify.options = {
target: function(href, type) { target: function(href, type) {
if (type === 'url') { if (type === 'url') {
const transformed = tryTransformPermalinkToLocalHref(href); try {
if (transformed !== href || decodeURIComponent(href).match(matrixLinkify.ELEMENT_URL_PATTERN)) { const transformed = tryTransformPermalinkToLocalHref(href);
return null; if (transformed !== href || decodeURIComponent(href).match(matrixLinkify.ELEMENT_URL_PATTERN)) {
} else { return null;
return '_blank'; } else {
return '_blank';
}
} catch (e) {
// malformed URI
} }
} }
return null; return null;

11
src/utils/permalinks/Permalinks.ts
View File

@ -346,9 +346,14 @@ export function tryTransformPermalinkToLocalHref(permalink: string): string {
return permalink; return permalink;
} }
const m = decodeURIComponent(permalink).match(matrixLinkify.ELEMENT_URL_PATTERN); try {
if (m) { const m = decodeURIComponent(permalink).match(matrixLinkify.ELEMENT_URL_PATTERN);
return m[1]; if (m) {
return m[1];
}
} catch (e) {
// Not a valid URI
return permalink;
} }
// A bit of a hack to convert permalinks of unknown origin to Element links // A bit of a hack to convert permalinks of unknown origin to Element links