@capillarytech/cap-ui-utils 2.0.0 → 2.0.2

package/index.js

@@ -8,3 +8,4 @@ export { default as validationHelper } from "./utils/validationHelper";
 export { default as loadable, FORCE_REFRESH_NOTIFIER, FORCE_REFRESH_SECONDS } from './utils/loadable';
 export { default as GTMTracker } from './utils/gtmTracker';
 export { default as compileHandlebars } from './utils/compileHandlebars';
+export { default as sanitizeTemplateWithRegexp } from "./utils/contentSanitizationHelper";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capillarytech/cap-ui-utils",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Utility functions shared accross all the modules",
   "main": "index.js",
   "scripts": {
@@ -12,7 +12,7 @@
     "react-ga": "^3.3.1",
     "tti-polyfill": "^0.2.2",
     "moment-timezone": "^0.5.25",
-    "react-intl": "6.6.6",
+    "react-intl": "2.7.2",
     "lodash": "4.17.11",
     "handlebars": "4.0.11"
   }

package/utils/constants.js

@@ -0,0 +1,108 @@
+// Constants used for sanitizing template content. These constants define various tags, attributes, and keywords that are considered potentially harmful in the context of an HTML template. They are used in the sanitization process to identify and remove or escape these harmful elements, helping to prevent Cross-Site Scripting (XSS) attacks.
+export const TMPL_SANITIZE_FORBIDDEN_TAGS = [
+  "script",
+  "fromCharCode",
+  "%73%63%72%69%70%74",
+  "object",
+  "embed",
+  "iframe",
+  "frameset",
+  "applet",
+  "WBR",
+  "layer",
+  "bgsound",
+  "XSS",
+];
+export const TMPL_SANITIZE_FORBIDDEN_ATTRS = [
+  "onclick",
+  "ondblclick",
+  "onmouseover",
+  "onmouseout",
+  "onkeydown",
+  "onkeyup",
+  "onkeypress",
+  "onfocus",
+  "onblur",
+  "onchange",
+  "onsubmit",
+  "onload",
+  "onerror",
+  "onscroll",
+  "onmouseup",
+  "onmousedown",
+  "onselect",
+  "onplay",
+  "onmousemove",
+  "onwheel",
+  "oninput",
+  "oncopy",
+  "oncut",
+  "onpaste",
+  "oncontextmenu",
+  "ondrag",
+  "ondragend",
+  "ondragenter",
+  "ondragleave",
+  "ondragover",
+  "ondragstart",
+  "ondrop",
+  "onabort",
+  "oncanplay",
+  "oncanplaythrough",
+  "oncuechange",
+  "ondurationchange",
+  "onemptied",
+  "onended",
+  "onloadeddata",
+  "onloadedmetadata",
+  "onloadstart",
+  "onpause",
+  "onplaying",
+  "onprogress",
+  "onratechange",
+  "onseeked",
+  "onseeking",
+  "onstalled",
+  "onsuspend",
+  "ontimeupdate",
+  "onvolumechange",
+  "onwaiting",
+  "onreset",
+  "onunload",
+  "onresize",
+  "ontoggle",
+  "onshow",
+  "onmousewheel",
+  "onsearch",
+  "oninvalid",
+  "onstorage",
+  "onpopstate",
+  "onpageshow",
+  "onpagehide",
+  "onoffline",
+  "ononline",
+  "onmessage",
+  "onhashchange",
+  "onbeforeunload",
+  "onbeforeprint",
+  "onafterprint",
+  "onmouseleave",
+  "onmouseenter",
+  "onstart",
+  "onbeforeload",
+  "onfilterchange",
+  "onbegin",
+  "onReadyStateChange",
+  "onPropertyChange",
+  "onend",
+];
+export const TMPL_SANITIZE_FORBIDDEN_JS_TAGS = [
+  "javascript:",
+  "javascript#",
+  "javascript:",
+  "javascriptalert",
+  "jscript",
+  "vbscript:",
+  "livescript:",
+  "xss:",
+];

package/utils/contentSanitizationHelper.js

@@ -0,0 +1,111 @@
+import {
+  TMPL_SANITIZE_FORBIDDEN_TAGS,
+  TMPL_SANITIZE_FORBIDDEN_ATTRS,
+  TMPL_SANITIZE_FORBIDDEN_JS_TAGS,
+} from "./constants";
+
+/**
+ * Sanitizes the given content by removing forbidden HTML tags, attributes, and JavaScript code.
+ *
+ * @param {string} content - The content to be sanitized.
+ * @returns {string} The sanitized content.
+ */
+const sanitizeTemplateWithRegexp = (content) => {
+  try {
+    const tagsJoined = TMPL_SANITIZE_FORBIDDEN_TAGS.join("|");
+    const attrsJoined = TMPL_SANITIZE_FORBIDDEN_ATTRS.join("|");
+    const jsKeywordsJoined = TMPL_SANITIZE_FORBIDDEN_JS_TAGS.join("|");
+
+    // Full tag regex: Matches complete HTML tags including their content for specified forbidden tags.
+    const fullTagRegex = new RegExp(
+      `<(${tagsJoined})\\b[^<]*(?:(?!<\/(${tagsJoined})>)<[^<]*)*<\/(${tagsJoined})>`,
+      "gi"
+    );
+    // Empty tag regex: Matches empty or self-closing instances of specified forbidden tags.
+    const emptyTagRegex = new RegExp(`<(${tagsJoined}).*\/?>`, "gi");
+    // Attribute regex: Matches forbidden attributes that can execute JavaScript or other actions.
+    const attrRegex = new RegExp(
+      `\\b(${attrsJoined})\\s*=\\s*((["'])(?:\\\\|\\.|[^\\"])*\\x03|&quot;(?:\\\\|\\.|[^\\&quot;])*&quot;|[^ >]*?)(?=\s*(?:\/?>|\/?&gt;))`,
+      "gi"
+    );
+    // Href with JavaScript regex: Matches 'href' and other js attributes that initiate with JavaScript or other harmful protocols.
+    const hrefJavaScriptRegex = new RegExp(
+      `href\\s*=\\s*(["\'])(?:\\*?.)*?(?:\\?\\")?(${jsKeywordsJoined})(?:\\\\?.)*?\\1`,
+      "gi"
+    );
+    // Href in JSON format for BEE editor: Specifically designed to match 'href' attributes within JSON strings that contain harmful JavaScript.
+    const hrefRegexForJsonString = new RegExp(
+      `href=\\\\["\'](${jsKeywordsJoined}).*?\\\\["\']`,
+      "gi"
+    );
+    // Encoded script tag regex: Matches script tags that are HTML entity encoded.
+    const encodedScriptTagRegex = new RegExp(
+      `(?:<(${tagsJoined})|&lt;(${tagsJoined})|&amp;lt;(${tagsJoined}))(.*?)(?:<\/(${tagsJoined})>|&lt;\/(${tagsJoined})>|\/>|\/(${tagsJoined})&gt;|\/&gt;|\/(${tagsJoined})&amp;gt;|\/(${tagsJoined}) --&gt;)`,
+      "gi"
+    );
+    // Src with JavaScript regex: Matches 'src' attributes that begin with JavaScript or other harmful protocols.
+    const srcWithJavaScriptRegex = new RegExp(
+      `src\\s*=\\s*(?:'|"|&quot;)?\\s*(${jsKeywordsJoined})[^\\s>]*(?=\\s*(>|\/>|&gt;|\/&gt;))`,
+      "gi"
+    );
+    // Unicode regex: Matches Unicode entities within the content.
+    const regexForUnicode = new RegExp(
+      "&#\\d+;|&#0*[0-9]+;|&#x[0-9a-zA-Z]+;|\\\\00[0-9a-zA-Z]{2,}",
+      "gi"
+    );
+    // Global JavaScript regex: Matches instances of JavaScript protocol globally.
+    const globalJavascriptRegex = new RegExp(
+      `(${jsKeywordsJoined})[^;"'>)]*([;"'>)]|\/>)`,
+      "gi"
+    );
+    // Style import regex: Matches '@import' used within <style> tags that might import harmful stylesheets.
+    const styleImportRegex = new RegExp(`@import[^<]*?(?=(<|&lt;|\/>))`, "gi");
+    // JavaScript built-in functions regex: Matches calls to 'alert', 'prompt', or 'confirm' that could be used for XSS.
+    const jsBuiltInFunctionRegex = new RegExp(
+      `\\b(alert|prompt|confirm)\\s*(\\(|&lpar;|&amp;lpar;)[^)]*(\\)|&rpar;|&amp;rpar;)`,
+      "gi"
+    );
+    // Hexadecimal code regex: Matches all hexadecimal HTML entities.
+    const hexCodeRegex = new RegExp(`((&|&amp;)#[xX]?[0-9a-fA-F]+;?)`, "gi");
+    // Immediate unclosed tag regex: Matches tags that are not properly closed and have URI encoded script tag.
+    const immediateUnclosedTagRegex = new RegExp(
+      `(?:<|&lt;|&amp;lt;|%3C)\\s*(${tagsJoined})\\b.*?(?:>|&gt;|&amp;gt;|%3E)([\\s\\S]*?)(?:<|&lt;|&amp;lt;|%3C)(\\/|%2F)\\s*(${tagsJoined})\\b.*?(?:>|&gt;|&amp;gt;|%3E)`,
+      "gi"
+    );
+    // Eval regex: Matches dangerous 'eval()' usage that could execute arbitrary JavaScript.
+    const evalRegex = new RegExp(
+      "[-\\/]?\\beval\\(([^)]|\\\\.|&\\w+;)+\\)[-\\/]?",
+      "gi"
+    );
+    const unclosedOrSelfClosedTagRegex = new RegExp(
+      `(?:<|&lt;|&amp;lt;|amp;lt;)\\s*(${tagsJoined})\\b[\\s\\S]*?(?:\/>|>|&gt;|\/&gt;|&amp;gt;|amp;gt;|\/&amp;gt;|\\Z)`,
+      "gi"
+    );
+    // regex to replace the &#39 (ascii html for apostrophe) to the apostrophe for ckeditor content
+		const apostropheRegex = new RegExp('&#39;', 'gi');
+
+    content = content
+      .replaceAll(apostropheRegex, '\'')
+      .replace(hexCodeRegex, "")
+      .replace(encodedScriptTagRegex, "")
+      .replace(fullTagRegex, "")
+      .replace(emptyTagRegex, "")
+      .replace(immediateUnclosedTagRegex, "")
+      .replace(attrRegex, "")
+      .replace(hrefJavaScriptRegex, 'href="#"')
+      .replace(hrefRegexForJsonString, 'href=\\"#\\"') // This will ensure to remain the content in json format for BEE editor
+      .replace(regexForUnicode, "")
+      .replace(srcWithJavaScriptRegex, 'src="#"')
+      .replace(globalJavascriptRegex, '""')
+      .replace(styleImportRegex, "")
+      .replace(jsBuiltInFunctionRegex, "")
+      .replace(unclosedOrSelfClosedTagRegex, "")
+      .replace(evalRegex, "");
+    return content;
+  } catch (err) {
+    console.error("Error while sanitizing template with Regexp", err, content);
+    return content;
+  }
+};
+
+export default sanitizeTemplateWithRegexp;