git.iko.soy/typeable/pandoc
on master help sign in
Fixed email javascript obfuscation with mailto: URLs.

This fixes a potential security issue. Because single quotes weren't being escaped in the link portion, a specially crafted email address could allow javascript code injection. [Jim'+alert('hi')+'OBrien](mailto:me@example.com) Closes #2280.

commit9e528f4c0ce47c3ae7d233ba9627d2ed3df60fd7 authorJohn MacFarlane <jgm@berkeley.edu> dateTue 7 Jul 2015, 11:15 (11 years ago) parent7398dea
2 files changed+3−3
compare with master
unifiedsplit
src/Text/Pandoc/Writers/HTML.hs+2−2 tests/writer.html+1−1
src/Text/Pandoc/Writers/HTML.hs+2−2
@@ -375,8 +375,8 @@ obfuscateLink opts (renderHtml -> txt) s =
375375 (linkText, altText) =
376376 if txt == drop 7 s' -- autolink
377377 then ("e", name' ++ " at " ++ domain')
378− else ("'" ++ txt ++ "'", txt ++ " (" ++ name' ++ " at " ++
379− domain' ++ ")")
378+ else ("'" ++ obfuscateString txt ++ "'",
379+ txt ++ " (" ++ name' ++ " at " ++ domain' ++ ")")
380380 in case meth of
381381 ReferenceObfuscation ->
382382 -- need to use preEscapedString or &'s are escaped to &amp; in URL
tests/writer.html+1−1
@@ -481,7 +481,7 @@ Blah
481481<p><script type="text/javascript">
482482<!--
483483h='&#110;&#x6f;&#x77;&#104;&#x65;&#114;&#x65;&#46;&#110;&#x65;&#116;';a='&#64;';n='&#110;&#x6f;&#98;&#x6f;&#100;&#x79;';e=n+a+h;
484−document.write('<a h'+'ref'+'="ma'+'ilto'+':'+e+'" clas'+'s="em' + 'ail">'+'Email link'+'<\/'+'a'+'>');
484+document.write('<a h'+'ref'+'="ma'+'ilto'+':'+e+'" clas'+'s="em' + 'ail">'+'&#x45;&#x6d;&#x61;&#x69;&#108;&#32;&#108;&#x69;&#110;&#x6b;'+'<\/'+'a'+'>');
485485// -->
486486</script><noscript>&#x45;&#x6d;&#x61;&#x69;&#108;&#32;&#108;&#x69;&#110;&#x6b;&#32;&#40;&#110;&#x6f;&#98;&#x6f;&#100;&#x79;&#32;&#x61;&#116;&#32;&#110;&#x6f;&#x77;&#104;&#x65;&#114;&#x65;&#32;&#100;&#x6f;&#116;&#32;&#110;&#x65;&#116;&#x29;</noscript></p>
487487<p><a href="">Empty</a>.</p>