Bommels05/Modrinth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "fix(xss): allow any query parameters in youtube embed, ported from #1001 (#1064)"

Browse Source 
This reverts commit f34845fd7d99dc46eb1e182a55e3b3f276245388.
This commit is contained in:
Emma Triphora 2023-05-06 14:56:59 -04:00
parent a6a6e73b04
commit c08139b812
No known key found for this signature in database
GPG Key ID: 665FFBF8458769F4
1 changed files with 3 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
helpers/parse.js
View File

@ -30,8 +30,8 @@ export const configuredXss = new xss.FilterXSS({
const allowedSources = [ const allowedSources = [
{ {
regex: regex:
/^https?:\/\/(www\.)?youtube(-nocookie)?\.com\/embed\/[a-zA-Z0-9_-]{11}((&|\?)\w+=\w+)*$/, /^https?:\/\/(www\.)?youtube(-nocookie)?\.com\/embed\/[a-zA-Z0-9_-]{11}(\?&autoplay=[0-1]{1})?$/,
remove: ['autoplay=1'], // Prevents autoplay remove: ['&autoplay=1'], // Prevents autoplay
}, },
{ {
regex: /^https?:\/\/(www\.)?discord\.com\/widget\?id=\d{18,19}(&theme=\w+)?$/, regex: /^https?:\/\/(www\.)?discord\.com\/widget\?id=\d{18,19}(&theme=\w+)?$/,
@ -42,22 +42,7 @@ export const configuredXss = new xss.FilterXSS({
for (const source of allowedSources) { for (const source of allowedSources) {
if (source.regex.test(value)) { if (source.regex.test(value)) {
for (const remove of source.remove) { for (const remove of source.remove) {
let index = value.indexOf(remove); value = value.replace(remove, '')
do {
if (index - 1 > 0 && value.charAt(index - 1) === '?') {
// need to watch out for two things
// case where its ?stand=alone
// case where its ?followed=by&another=queryParam
if (index + remove.length < value.length && value.charAt(index + remove.length) === '&') {
value = value.replace(`${remove}&`, '');
} else if (index + remove.length >= value.length) {
value = value.replace(`?${remove}`, '');
}
} else {
value = value.replaceAll(`&${remove}`, ''); // can safely be removed
}
index = value.indexOf(remove);
} while (index !== -1);
} }
return name + '="' + xss.escapeAttrValue(value) + '"' return name + '="' + xss.escapeAttrValue(value) + '"'
} }