fix(sanitiseUrl): fix limitations with library #1821
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This stack of pull requests is managed by Graphite. Learn more about stacking. Join @kishore03109 and the rest of your teammates on |
kishore03109
force-pushed
the
03-05-fix_sanitiseUrl_fix_limitations_with_library
branch
from
4b83b15 to
da1888f
Compare
mergify
bot
deleted the
03-05-fix_sanitiseUrl_fix_limitations_with_library
branch
dcshzj
added a commit
that referenced
this pull request
Mar 11, 2024
* fix(media): should not have files that begin with underscore (#1819) ## Problem currently files that start with _ are ignored. this means that in the final output, the site does not have the broken link. this issue is quite existent in our sites (eg. https://www.cdc.gov.sg/our-programmes/gallery/2021/) when i did a string search, this lead to quite a number of sites with these types of images. this is not ideal, and as such this edge case will be coded out as part of the link checker for user to fix Tests - [ ] enter into a repo and try to rename an image into something with an leading underscore. - [ ] asset that you get the error message as shown below  - [ ] upload an image named '_name.png' into the images folder. assert that the leading underscore gets stripped off https://github.com/isomerpages/isomercms-frontend/assets/42832651/1ce91503-04b0-442e-8fef-10ae99e3129c * fix(sanitiseUrl): fix limitations with library (#1821) ## Problem The sanitize-url library does filters HTML entities, but it does not do so recursively. By nesting HTML entities, it is possible to create a URL which specifies the JavaScript protocol handler. Closes GTA-24-006 ## Solution Handroll a quick url constructor and check that the protocols are adhered to. **Breaking Changes** <!-- Does this PR contain any backward incompatible changes? If so, what are they and should there be special considerations for release? --> - [ ] Yes - this PR contains breaking changes - Details ... - [X] No - this PR is backwards compatible with ALL of the following feature flags in this [doc](https://www.notion.so/opengov/Existing-feature-flags-518ad2cdc325420893a105e88c432be5) ## Tests <!-- What tests should be run to confirm functionality? --> - [ ] Login via github and visit "http://localhost:3000/sites/kishore-test-dev-gh/contact-us" - [ ] when hovering over `[+65 6123 4589](tel:+6561234589)` verify that it links to `tel:+6561234589` - [ ] when hovering over `[[email protected]](mailto:[email protected])` verify that it links to `[email protected]` - [ ] when hovering over `[online form](https://www.form.gov.sg/)` verify that it links to `https://www.form.gov.sg/` <img width="533" alt="Screenshot 2024-03-05 at 1 10 36 PM" src="https://github.com/isomerpages/isomercms-frontend/assets/42832651/87c5edbb-8744-47d1-8b9d-01f38893dc15"> * 0.81.0 --------- Co-authored-by: Alexander Lee <[email protected]> Co-authored-by: Kishore <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
The sanitize-url library does filters HTML entities, but it does not do so recursively. By nesting HTML entities, it is possible to create a URL which specifies the JavaScript protocol handler.
Closes GTA-24-006
Solution
Handroll a quick url constructor and check that the protocols are adhered to.
Breaking Changes
Tests
[+65 6123 4589](tel:+6561234589)verify that it links totel:+6561234589[[email protected]](mailto:[email protected])verify that it links to[email protected][online form](https://www.form.gov.sg/)verify that it links tohttps://www.form.gov.sg/