Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(frontend): security XSS / image tag #4030

Merged
merged 25 commits into from
Dec 10, 2021
Merged

fix(frontend): security XSS / image tag #4030

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
1ded610
fix: html and security
maxgfr Nov 19, 2021
146e208
fix: add jsdom
maxgfr Nov 19, 2021
c898b28
fix: jsdom
maxgfr Nov 19, 2021
3d61b9c
fix: dynamic import
maxgfr Nov 19, 2021
08931b5
fix: jsdom
maxgfr Nov 19, 2021
1287dc9
fix: html and security
maxgfr Nov 19, 2021
595d73c
fix: lib
maxgfr Nov 19, 2021
3b962bf
fix: snapshot
maxgfr Nov 19, 2021
5905abb
fix: image
maxgfr Nov 19, 2021
cdd43d4
fix: pb
maxgfr Nov 22, 2021
1490fc4
fix: image
maxgfr Nov 22, 2021
a7cc140
Merge branch 'master' into maxgfr/image-affichage
maxgfr Nov 25, 2021
72b247e
fix: codedutravail
maxgfr Nov 25, 2021
e7af0eb
fix: codedutravail
maxgfr Nov 25, 2021
2906e98
fix: test
maxgfr Nov 25, 2021
2dcd5b1
fix: test
maxgfr Nov 25, 2021
8e0b13e
fix: image
maxgfr Nov 26, 2021
048629c
Merge branch 'master' into maxgfr/image-affichage
maxgfr Dec 1, 2021
5624b67
fix: rel
maxgfr Dec 1, 2021
ee4f64c
fix
maxgfr Dec 1, 2021
0a992d6
Merge branch 'master' into maxgfr/image-affichage
maxgfr Dec 1, 2021
0bdc026
fix: value
maxgfr Dec 2, 2021
932b31a
remove unsued code
maxgfr Dec 2, 2021
d7d39e9
Merge branch 'master' into maxgfr/image-affichage
m-maillot Dec 9, 2021
35b53d9
fix: add webcomponent-tooltip-cc to whitelist tag
m-maillot Dec 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions ...ges/code-du-travail-frontend/__tests__/__snapshots__/fiche-ministere-travail.test.js.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2329,7 +2329,9 @@ exports[`<FicheMT /> should render 1`] = `
<div
class="c54 c55"
>
<div>
<div
class=""
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

c'est bizarre que ça rajoute une class vide

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oui, c'est vrai, bonne question

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

En vrai, c'est dû au parsing fait par le xss, qui essaye de retirer le plus de choses externes. Mais en soit, relou si ça génère des <div class="" .. dans la prod

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dans la prod, il me semble que ça ne génère pas cela, donc pour moi c'est ok j'ai l'impression

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

c'est juste qu'avant on l'ajoutait pas et maintenant oui

>
lorem ipsum intro
</div>
</div>
Expand Down Expand Up @@ -2441,14 +2443,11 @@ exports[`<FicheMT /> should render 1`] = `
</strong>
consultez
<a
class="spip_in"
href="https://travail-emploi.gouv.fr/sante-au-travail/suivi-de-la-sante-au-travail-10727/article/le-suivi-de-l-etat-de-sante-des-salaries"
rel="nofollow, noopener"
carolineBda marked this conversation as resolved.
Show resolved Hide resolved
target="_blank"
>
notre fiche sur le suivi de l’état de santé des salariés
</a>
.
</p>
</div>
</div>
Expand Down
4 changes: 3 additions & 1 deletion packages/code-du-travail-frontend/__tests__/__snapshots__/glossaire-[slug].test.js.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1384,7 +1384,9 @@ exports[`<Term /> should render 1`] = `
Définition
</th>
<td>
<div>
<div
class=""
>
<p>
Accord collectif de travail conclu au niveau d'une entreprise.
</p>
Expand Down
8 changes: 6 additions & 2 deletions ...code-du-travail-frontend/__tests__/__snapshots__/modeles-de-courriers-[slug].test.js.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2435,7 +2435,9 @@ exports[`<ModelesDeCourrier /> should render 1`] = `
<div
class="c52 c53"
>
<div>
<div
class=""
>
un description
</div>
</div>
Expand Down Expand Up @@ -2508,7 +2510,9 @@ exports[`<ModelesDeCourrier /> should render 1`] = `
<div
class="c26"
>
<div>
<div
class=""
>
<p>
youhou
</p>
Expand Down
4 changes: 3 additions & 1 deletion packages/code-du-travail-frontend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
"@socialgouv/reference-article": "^1.0.1",
"@ungap/url-search-params": "^0.2.2",
"@zeit/next-source-maps": "^0.0.3",
"cheerio": "^1.0.0-rc.10",
"date-fns": "^2.22.1",
"debounce-promise": "^3.1.2",
"final-form": "^4.20.2",
Expand Down Expand Up @@ -74,7 +75,8 @@
"styled-components": "^5.3.0",
"typescript": "^4.3.5",
"unified": "^9.2.2",
"uuid": "^8.3.2"
"uuid": "^8.3.2",
"xss": "^1.0.10"
},
"devDependencies": {
"@babel/core": "^7.14.8",
Expand Down
16 changes: 0 additions & 16 deletions packages/code-du-travail-frontend/src/common/Html.js
View file
Open in desktop

This file was deleted.

29 changes: 29 additions & 0 deletions packages/code-du-travail-frontend/src/common/Html.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
import React from "react";
import styled from "styled-components";
import xss from "xss";

import { htmlParser } from "../lib";

type Props = {
children: string;
inline?: boolean;
};

const Html = ({ children, inline = false, ...props }: Props): JSX.Element => {
return (
<Div
{...props}
isInline={inline}
dangerouslySetInnerHTML={{
__html: xss(htmlParser(children)),
}}
/>
);
};

export default Html;

const Div = styled.div`
${({ isInline }: { isInline: boolean }) =>
isInline && "display: inline-block;"};
`;
99 changes: 57 additions & 42 deletions packages/code-du-travail-frontend/src/common/__tests__/__snapshots__/Answer.test.js.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -877,14 +877,16 @@ exports[`<Answer /> should renders 1`] = `
<div
class="c20 c21"
>
<div>
<div
class=""
>
intro de l'article
</div>
</div>
<div>
<p
class="test-content"
>
<div
class=""
>
<p>
Contenu au format
<strong>
html
Expand Down Expand Up @@ -2182,14 +2184,16 @@ exports[`<Answer /> should renders a breadcrumbs 1`] = `
<div
class="c30 c31"
>
<div>
<div
class=""
>
intro de l'article
</div>
</div>
<div>
<p
class="test-content"
>
<div
class=""
>
<p>
Contenu au format
<strong>
html
Expand Down Expand Up @@ -3237,14 +3241,16 @@ exports[`<Answer /> should renders back to results link 1`] = `
<div
class="c20 c21"
>
<div>
<div
class=""
>
intro de l'article
</div>
</div>
<div>
<p
class="test-content"
>
<div
class=""
>
<p>
Contenu au format
<strong>
html
Expand Down Expand Up @@ -4405,14 +4411,16 @@ exports[`<Answer /> should renders related content 1`] = `
<div
class="c20 c21"
>
<div>
<div
class=""
>
intro de l'article
</div>
</div>
<div>
<p
class="test-content"
>
<div
class=""
>
<p>
annualisation du temps de travail. Annualisation de l'annualisation.
</p>
</div>
Expand Down Expand Up @@ -5615,14 +5623,16 @@ exports[`<Answer /> should renders tooltip 1`] = `
<div
class="c20 c21"
>
<div>
<div
class=""
>
intro de l'article
</div>
</div>
<div>
<p
class="test-content"
>
<div
class=""
>
<p>
Contenu au format
<strong>
html
Expand Down Expand Up @@ -6671,14 +6681,16 @@ exports[`<Answer /> should renders tooltip for words with diacritics without bre
<div
class="c20 c21"
>
<div>
<div
class=""
>
intro de l'article
</div>
</div>
<div>
<p
class="test-content"
>
<div
class=""
>
<p>
Contenu au format
<strong>
indemnités
Expand Down Expand Up @@ -7727,17 +7739,18 @@ exports[`<Answer /> should renders tooltip without breaking a tag 1`] = `
<div
class="c20 c21"
>
<div>
<div
class=""
>
intro de l'article
</div>
</div>
<div>
<p
class="test-content"
>
<div
class=""
>
<p>
<a
class="spip_in"
href="emploi/accompagnement-des-mutations-economiques/csp"
maxgfr marked this conversation as resolved.
Show resolved Hide resolved
href=""
>
le contrat de sécurisation professionnelle APE
</a>
Expand Down Expand Up @@ -8784,14 +8797,16 @@ exports[`<Answer /> should renders tooltip without breaking previous word 1`] =
<div
class="c20 c21"
>
<div>
<div
class=""
>
intro de l'article
</div>
</div>
<div>
<p
class="test-content"
>
<div
class=""
>
<p>
annualisation du temps de travail. Annualisation de l'annualisation.
</p>
</div>
Expand Down
4 changes: 3 additions & 1 deletion packages/code-du-travail-frontend/src/common/__tests__/__snapshots__/Html.test.js.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@

exports[`<Html /> should render 1`] = `
<div>
<div>
<div
class=""
>
<b>
Hello
</b>
Expand Down
Loading