@reality.eth/reality-eth-lib 3.1.13 → 3.1.15

package/formatters/question.js

@@ -5,6 +5,8 @@ const BigNumber = require('bignumber.js');
 const ethereumjs_abi = require('ethereumjs-abi')
 const vsprintf = require("sprintf-js").vsprintf
 const QUESTION_MAX_OUTCOMES = 128;
+const marked = require('marked');
+const DOMPurify = require('isomorphic-dompurify');
 
 exports.delimiter = function() {
     return '\u241f'; // Thought about '\u0000' but it seems to break something;
@@ -173,6 +175,10 @@ exports.secondsTodHms = function(sec) {
 
 exports.parseQuestionJSON = function(data, errors_to_title) {
 
+    // Strip unicode null-terminated-string control characters if there are any.
+    // These seem to be stripped already if we got data via The Graph, and only passed to us on RPC.
+    data = data.replace(/\u0000/g, "");
+    
     var question_json;
     try {
         question_json = JSON.parse(data);
@@ -183,28 +189,79 @@ exports.parseQuestionJSON = function(data, errors_to_title) {
             'errors': {"json_parse_failed": true}
         };
     }
-    if (question_json['outcomes'] && question_json['outcomes'].length > QUESTION_MAX_OUTCOMES) {
-        question_json['errors'] = {'too_many_outcomes': true}
+
+    if (question_json['outcomes'] && question_json['outcomes'].length > QUESTION_MAX_OUTCOMES)
+        if(question_json['errors'])
+            question_json['errors']['too_many_outcomes'] = true
+        else
+            question_json['errors'] = {'too_many_outcomes': true};
+    if ('type' in question_json && question_json['type'] == 'datetime' && 'precision' in question_json) 
+        if (!(['Y', 'm', 'd', 'H', 'i', 's'].includes(question_json['precision'])))
+            if(question_json['errors'])
+                question_json['errors']['invalid_precision'] = true
+            else
+                question_json['errors'] = {'invalid_precision': true};
+    // If errors_to_title is specified, we add any error message to the title to make sure we don't lose it
+    if (errors_to_title) {
+        if ('errors' in question_json) {
+            const prependers = {
+                'invalid_precision': 'Invalid date format',
+                'too_many_outcomes': 'Too many outcomes'
+            }
+            for (const e in question_json['errors']) {
+                if (e in prependers) {
+                    question_json['title'] = '['+prependers[e]+'] ' + question_json['title'];
+                }
+            }
+        }
     }
-    if ('type' in question_json && question_json['type'] == 'datetime' && 'precision' in question_json) {
-        if (!(['Y', 'm', 'd', 'H', 'i', 's'].includes(question_json['precision']))) {
-            question_json['errors'] = {'invalid_precision': true};
+
+    try{
+        switch(question_json['format']){
+            case 'text/markdown':{
+                const safeMarkdown = DOMPurify.sanitize(question_json['title'], { USE_PROFILES: {html: false}});
+                if (safeMarkdown !== question_json['title'])
+                    if(question_json['errors'])
+                        question_json['errors']['unsafe_markdown'] = true;
+                    else
+                        question_json['errors'] = {'unsafe_markdown': true};
+                else
+                    question_json['title-markdown-html'] = marked.parse(safeMarkdown).replace(/<img.*src=\"(.*?)\".*alt=\"(.*?)\".*\/?>/, '<a href="$1">$2</a>');
+                break;
+            }
+            case 'text/plain': {
+                break;
+            }
+            case undefined:{
+                question_json['format'] = 'text/plain';
+                break;
+            }
+            default:{
+                question_json['errors'] = {'invalid_format': true};            
+                break;
+            }
         }
+    } catch(e){
+        if(question_json && question_json['errors'])
+            question_json['errors']['markdown_parse_failed'] = true
     }
+
     // If errors_to_title is specified, we add any error message to the title to make sure we don't lose it
     if (errors_to_title) {
         if ('errors' in question_json) {
             const prependers = {
-                'invalid_precision': 'Invalid date format',
-                'too_many_outcomes': 'Too many outcomes'
+                'invalid_format': 'Invalid format',
+                'unsafe_markdown': 'Unsafe markdown',
+                'markdown_parse_failed': 'Bad markdown parse'
             }
-            for (var e in question_json['errors']) {
+            for (const e in question_json['errors']) {
                 if (e in prependers) {
                     question_json['title'] = '['+prependers[e]+'] ' + question_json['title'];
                 }
             }
         }
     }
+
     return question_json;
 
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reality.eth/reality-eth-lib",
-  "version": "3.1.13",
+  "version": "3.1.15",
   "description": "Tools for handling questions in the reality.eth fact verification platform",
   "scripts": {
     "test": "env TZ='Asia/Kabul' mocha ./test"
@@ -16,10 +16,12 @@
   "author": "Edmund Edgar (https://reality.eth.link)",
   "license": "GPL-3.0",
   "dependencies": {
-    "@reality.eth/contracts": "^3.0.15",
+    "@reality.eth/contracts": "^3.0.16",
     "bignumber.js": "^7.2.1",
     "bn.js": "^5.2.1",
     "ethereumjs-abi": "^0.6.5",
+    "isomorphic-dompurify": "^0.23.0",
+    "marked": "^4.1.1",
     "sprintf-js": "^1.1.1"
   },
   "devDependencies": {
@@ -36,5 +38,5 @@
     "url": "https://github.com/RealityETH/monorepo/issues"
   },
   "homepage": "https://reality.eth.link",
-  "gitHead": "4601364942fcc90d5f93f10f53e3934c7e772d46"
+  "gitHead": "5b0b4dd179e68567d2a0086fc10a6d0f9967af47"
 }

package/test/formatters.js

@@ -200,7 +200,6 @@ describe('Answer strings', function() {
     var qtext = rc_question.encodeText('multiple-select', 'oink', outcomes, 'my-category');
     var q1 = rc_question.populatedJSONForTemplate(rc_template.defaultTemplateForType('multiple-select'), qtext);
     expect(q1.errors.too_many_outcomes).to.equal(true);
-    console.log(q1.title);
     expect(q1.title).to.equal('oink');
     var q2 = rc_question.populatedJSONForTemplate(rc_template.defaultTemplateForType('multiple-select'), qtext, true);
     expect(q2.errors.too_many_outcomes).to.equal(true);
@@ -241,6 +240,20 @@ describe('Broken questions', function() {
   });
 });
 
+describe('Unsafe markdown questions', function() {
+  it('Sets an error if a question includes unsafe html in markdown', function() {
+    const qUnsafeMarkdown = "{\"title\": \"# Title <p>abc<iframe\/\/src=jAva&Tab;script:alert(3)>def<\/p>\", \"type\": \"bool\", \"category\": \"art\", \"lang\": \"en_US\", \"format\": \"text/markdown\"}";
+    const q = rc_question.parseQuestionJSON(qUnsafeMarkdown, true);
+    expect(q.errors.unsafe_markdown).to.equal(true);
+  });
+  it('Sets no error if a question includes valid markdown without html', function() {
+    const qUnsafeMarkdown = "{\"title\": \"# Title\", \"type\": \"bool\", \"category\": \"art\", \"lang\": \"en_US\", \"format\": \"text/markdown\"}";
+    const q = rc_question.parseQuestionJSON(qUnsafeMarkdown, true);
+    expect(q.errors).to.equal(undefined);
+    expect(q.format).to.equal('text/markdown');
+  });
+});
+
 describe('Commitment ID tests', function() {
   // Using rinkeby question:
   // 0xa09ce5e7943f281a782a0dc021c4029f9088bec4-0x0ade9a55d4dfca644062792d8e66cec9fbd5579761d760a6e0ae9856e81086a4