archive/BookStackApp_BookStack
0
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-05-16 13:31:25 +00:00
Code Issues Projects Releases Wiki Activity

Comments: Added HTML filter on load, tinymce elem filtering

Browse source 
- Added filter on load to help prevent potentially dangerous comment
  HTML in DB at load time (if it gets passed input filtering, or is
  existing).
- Added TinyMCE valid_elements for input wysiwygs, to gracefully degrade
  content at point of user-view, rather than surprising the user by
  stripping content, which TinyMCE would show, post-save.
This commit is contained in:
Dan Brown 2024-01-31 16:20:22 +00:00
parent e9a19d5878
commit 06901b878f
No known key found for this signature in database
GPG key ID: 46D9F943C24A2EF9
4 changed files with 27 additions and 4 deletions
tests/Entity
CommentTest.php

17
tests/Entity/CommentTest.php
View file

@ -82,11 +82,10 @@ class CommentTest extends TestCase
public function test_scripts_cannot_be_injected_via_comment_html()
{
$this->asAdmin();
$page = $this->entities->page();
$script = '<script>const a = "script";</script><p onclick="1">My lovely comment</p>';
$this->postJson("/comment/$page->id", [
$this->asAdmin()->postJson("/comment/$page->id", [
'html' => $script,
]);
@ -104,6 +103,20 @@ class CommentTest extends TestCase
$pageView->assertSee('<p>My lovely comment</p><p>updated</p>');
}
public function test_scripts_are_removed_even_if_already_in_db()
{
$page = $this->entities->page();
Comment::factory()->create([
'html' => '<script>superbadscript</script><p onclick="superbadonclick">scriptincommentest</p>',
'entity_type' => 'page', 'entity_id' => $page
]);
$resp = $this->asAdmin()->get($page->getUrl());
$resp->assertSee('scriptincommentest', false);
$resp->assertDontSee('superbadscript', false);
$resp->assertDontSee('superbadonclick', false);
}
public function test_reply_comments_are_nested()
{
$this->asAdmin();