@mablhq/mabl-cli 1.50.5 → 1.52.2

package/resources/pdf-viewer/embeddedPdfDetection.js

@@ -48,13 +48,69 @@ mablEmbeddedPdfDetector = () => {
     }
   }
 
+  /**
+   * Returns the URL string of the element which should in some way be embedding a PDF.
+   * @param {HTMLElement} originalPdfElement The element embedding the PDF, should have embed tag, object tag,
+   * @returns {(string|undefined)} The URL which should host the PDF, or undefined if none was found
+   */
+  function getPdfUrlFromElement(originalPdfElement) {
+    return (
+      originalPdfElement.src ||
+      originalPdfElement.data || // embed has @src, object has @data
+      undefined
+    );
+  }
+
+  /**
+   * Checks that the URL embedding the PDF leads to a valid location and/or
+   * has a valid protocol
+   * @param {HTMLElement} element The element on the page whose URL to check
+   * @returns {boolean} Whether or not the element is valid
+   */
+  function checkUrlProtocol(element) {
+    if (element.src === 'about:blank') {
+      // this is likely the chrome viewer for a POST
+      // don't do anything, we might get a manual update later
+      // if the trainer finds a PDF
+      return false;
+    }
+    // Validate that the URL is an allowed protocol to prevent XSS, see IST-561
+    const pdfUrlString = getPdfUrlFromElement(element);
+    try {
+      const pdfUrl = new URL(pdfUrlString);
+      // data: is allowed to support embedding the PDF inline using a data URI scheme
+      const allowedProtocols = ['http:', 'https:', 'data:'];
+      if (!allowedProtocols.includes(pdfUrl?.protocol)) {
+        console.warn(
+          `PDF Handler ignoring element with URL ${pdfUrlString} because protocol ${pdfUrl?.protocol} does not match one of the allowed protocols ${allowedProtocols}`,
+        );
+        return false;
+      } else if (
+        pdfUrl?.protocol === 'data:' &&
+        !/^data:application\/pdf[,;]/.test(pdfUrl?.href ?? '') // starts with data:application/pdf and either , or ; separator
+      ) {
+        console.warn(
+          `PDF Handler ignoring element with URL ${pdfUrlString} because it does not use application/pdf MIME type`,
+        );
+        return false;
+      }
+    } catch (e) {
+      console.warn(
+        `PDF Handler ignoring element with URL ${pdfUrlString}; error ${e} was thrown while converting to URL`,
+      );
+      return false;
+    }
+    return true;
+  }
+
   async function handle(event) {
     const element = event.target;
     if (
       checkAnimationEvent(event) &&
       checkElement(element) &&
       checkMimeType(element) &&
-      !isMablMarked(element)
+      !isMablMarked(element) &&
+      checkUrlProtocol(element)
     ) {
       const baseUri = document.baseURI;
       const pdfElement = element;
@@ -100,7 +156,7 @@ mablEmbeddedPdfDetector = () => {
 
   function checkMimeType(element) {
     const mimeType = element.type;
-    const path = element.src || element.data; // src for embed, data for object
+    const path = getPdfUrlFromElement(element);
     const isAPdf =
       (mimeType && mimeType.toLowerCase() === 'application/pdf') || // mime type is PDF
       (!mimeType && path && /\.pdf($|[?#])/i.test(path)) || // or if we don't have a mime type test the path up to query or hash
@@ -130,6 +186,7 @@ const MABL_DEFAULT_PDF_NAME = 'mablPdf';
 function documentHasDocType() {
   return document.doctype && document.doctype.name;
 }
+
 function runEmbeddedPdfDetector() {
   if (documentHasDocType()) {
     mablEmbeddedPdfDetector();