@ecency/render-helper 2.2.35 → 2.2.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/lib/proxify-image-src.d.ts +1 -0
  2. package/lib/proxify-image-src.js +11 -2
  3. package/lib/proxify-image-src.js.map +1 -1
  4. package/lib/render-helper.js +1 -1
  5. package/package.json +1 -1
  6. package/src/proxify-image-src.ts +10 -1
  7. package/src/test/data/legacy/10.json +1 -1
  8. package/src/test/data/legacy/23.json +1 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ecency/render-helper",
3
- "version": "2.2.35",
3
+ "version": "2.2.36",
4
4
  "description": "Markdown+Html Render helper",
5
5
  "main": "lib/index.js",
6
6
  "types": "lib/index.d.ts",
package/src/proxify-image-src.ts CHANGED
@@ -15,13 +15,22 @@ export function extractPHash(url: string): string | null {
15
15
  return null
16
16
  }
17
17
 
18
+ export function isValidUrl(url: string): boolean {
19
+ try {
20
+ return Boolean(new URL(url));
21
+ }
22
+ catch(e){
23
+ return false;
24
+ }
25
+ }
26
+
18
27
  export function getLatestUrl(str: string): string {
19
28
  const [last] = [...str.replace(/https?:\/\//g, '\n$&').trim().split('\n')].reverse()
20
29
  return last
21
30
  }
22
31
 
23
32
  export function proxifyImageSrc(url?: string, width = 0, height = 0, format = 'match') {
24
- if (!url || typeof url !== 'string') {
33
+ if (!url || typeof url !== 'string' || !isValidUrl(url)) {
25
34
  return ''
26
35
  }
27
36
 
package/src/test/data/legacy/10.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
2
  "id": 10,
3
3
  "input": "Lorem ipsum dolor <img src=x onerror=alert(x)> sit amet.\n\n<a href=\"javascript:void(0)\">etiam ut sollicitudin neque</a>\n\n<a onclick=\"console.log('ss')\">Vivamus pulvinar semper porttitor</a>",
4
- "result": "<p dir=\"auto\">Lorem ipsum dolor <img src=\"https://images.ecency.com/p/35.png?format=match&amp;mode=fit\" /> sit amet.</p>\n<p dir=\"auto\"><a>etiam ut sollicitudin neque</a></p>\n<p dir=\"auto\"><a>Vivamus pulvinar semper porttitor</a></p>"
4
+ "result": "<p dir=\"auto\">Lorem ipsum dolor <img /> sit amet.</p>\n<p dir=\"auto\"><a>etiam ut sollicitudin neque</a></p>\n<p dir=\"auto\"><a>Vivamus pulvinar semper porttitor</a></p>"
5
5
  }
package/src/test/data/legacy/23.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
2
  "id": 23,
3
3
  "input": "<IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"></img> <img src=x onerror=\"&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041\"> <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;> <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> <IMG SRC=\" &#14; javascript:alert('XSS');\">",
4
- "result": "<p dir=\"auto\">&lt;IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"&gt; <img src=\"https://images.ecency.com/p/35.png?format=match&amp;mode=fit\" /> &lt;IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;&gt; <img /> <img /></p>"
4
+ "result": "<p dir=\"auto\">&lt;IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"&gt; <img /> &lt;IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;&gt; <img /> <img /></p>"
5
5
  }