ep_hide_referrer 0.0.60 → 0.0.61

package/.github/workflows/backend-tests.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           repository: ether/etherpad-lite
           path: etherpad-lite
-      - uses: pnpm/action-setup@v3
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           version: 10

package/.github/workflows/frontend-tests.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v3
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           version: 10

package/.github/workflows/npmpublish.yml

@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           version: 10
@@ -59,12 +59,20 @@ jobs:
           [ "${NEW_COMMITS}" -gt 0 ] || exit 0
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          pnpm i
+          pnpm i --frozen-lockfile
           # `pnpm version patch` bumps package.json, makes a commit, and creates
           # a `v<new-version>` tag. Capture the new tag name from package.json
           # rather than parsing pnpm's output, which has historically varied.
-          pnpm version patch
-          NEW_TAG="v$(node -p "require('./package.json').version")"
+          # Bump the patch component directly with Node. pnpm/action-setup@v6
+          # sometimes installs pnpm 11 pre-releases even when version: 10.x is
+          # requested (pnpm/action-setup#225); those pre-releases either skip
+          # the git commit/tag or reject --no-git-tag-version as unknown.
+          # Doing the bump in Node sidesteps both failure modes.
+          NEW_VERSION=$(node -e "const fs=require('fs');const p=require('./package.json');const v=p.version.split('.');v[2]=String(Number(v[2])+1);p.version=v.join('.');fs.writeFileSync('./package.json',JSON.stringify(p,null,2)+'\n');console.log(p.version);")
+          NEW_TAG="v${NEW_VERSION}"
+          git add package.json
+          git commit -m "${NEW_TAG}"
+          git tag -a "${NEW_TAG}" -m "${NEW_TAG}"
           # CRITICAL: use --atomic so the branch update and the tag update
           # succeed (or fail) as a single transaction on the server. The old
           # `git push --follow-tags` was non-atomic per ref: if a concurrent

package/README.md

@@ -1,3 +1,20 @@
 ![Publish Status](https://github.com/ether/ep_hide_referrer/workflows/Node.js%20Package/badge.svg) [![Backend Tests Status](https://github.com/ether/ep_hide_referrer/actions/workflows/test-and-release.yml/badge.svg)](https://github.com/ether/ep_hide_referrer/actions/workflows/test-and-release.yml)
 
 A patch to solve the [referrer leak issue](https://github.com/ether/etherpad-lite/issues/1603) (for applications where the pad id is should be confidential)
+
+## Installation
+
+Install from the Etherpad admin UI (**Admin → Manage Plugins**,
+search for `ep_hide_referrer` and click *Install*), or from the Etherpad
+root directory:
+
+```sh
+pnpm run plugins install ep_hide_referrer
+```
+
+> ⚠️ Don't run `npm i` / `npm install` yourself from the Etherpad
+> source tree — Etherpad tracks installed plugins through its own
+> plugin-manager, and hand-editing `package.json` can leave the
+> server unable to start.
+
+After installing, restart Etherpad.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ep_hide_referrer",
   "description": "Don't pass the referring URL to third parties.  This handles the security/privacy issue where you don't want the third party service to know your pad URL.  Improves Privacy.",
-  "version": "0.0.60",
+  "version": "0.0.61",
   "author": "johnyma22 (John McLear) <john@mclear.co.uk>",
   "contributors": [],
   "repository": {
@@ -17,8 +17,8 @@
   },
   "devDependencies": {
     "eslint": "^8.57.1",
-    "eslint-config-etherpad": "^4.0.4",
-    "typescript": "^6.0.2"
+    "eslint-config-etherpad": "^4.0.5",
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "lint": "eslint .",

package/static/js/index.js

@@ -4,20 +4,20 @@ exports.postAceInit = (hook, context) => {
   const $inner =
       $('iframe[name="ace_outer"]').contents().find('iframe').contents().find('#innerdocbody');
   $inner.on('click', 'a', (e) => {
-    window.open(`../redirect#${escape(e.currentTarget.href)}`);
+    window.open(`../redirect#${encodeURIComponent(e.currentTarget.href)}`);
     e.preventDefault();
     return false;
   });
 
   $inner.on('contextmenu', 'a', function (e) {
-    $(this).attr('href', `../redirect#${escape(e.currentTarget.href)}`);
+    $(this).attr('href', `../redirect#${encodeURIComponent(e.currentTarget.href)}`);
   });
 
   $('#chattext').on('click', 'a', function (e) {
     if ($(this).hasClass('no-referrer')) {
       window.open(e.currentTarget.href);
     } else {
-      window.open(`../redirect#${escape(e.currentTarget.href)}`);
+      window.open(`../redirect#${encodeURIComponent(e.currentTarget.href)}`);
     }
     e.preventDefault();
     return false;
@@ -27,14 +27,14 @@ exports.postAceInit = (hook, context) => {
     if (!$(this).hasClass('no-referrer')) {
       $(this).attr('rel', 'noreferrer');
       $(this).addClass('no-referrer');
-      $(this).attr('href', `../redirect#${escape(e.currentTarget.href)}`);
+      $(this).attr('href', `../redirect#${encodeURIComponent(e.currentTarget.href)}`);
     }
   });
 };
 
 exports.postTimesliderInit = (hook, context) => {
   $('#padcontent').on('click', 'a', (e) => {
-    window.open(`../../redirect#${escape(e.currentTarget.href)}`);
+    window.open(`../../redirect#${encodeURIComponent(e.currentTarget.href)}`);
     e.preventDefault();
     return false;
   });

package/static/tests/backend/specs/redirect.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const assert = require('assert').strict;
+const fs = require('fs');
+const path = require('path');
+const common = require('ep_etherpad-lite/tests/backend/common');
+
+let agent;
+
+describe(__filename, function () {
+  before(async function () {
+    agent = await common.init();
+  });
+
+  describe('GET /redirect', function () {
+    it('serves the redirect template (regression for #80: no double-decode)', async function () {
+      const res = await agent.get('/redirect').expect(200).expect('Content-Type', /html/);
+      const html = res.text;
+      // The fix removes unescape() and decodes exactly once. If somebody
+      // re-introduces unescape() or a second decodeURIComponent(), we want
+      // the test to fail before users hit broken Google Maps Plus Code URLs
+      // again.
+      assert(!/\bunescape\s*\(/.test(html), 'redirect template must not use unescape()');
+      const decodeCount = (html.match(/decodeURIComponent\s*\(/g) || []).length;
+      assert.equal(decodeCount, 1,
+          `redirect template must call decodeURIComponent exactly once (found ${decodeCount})`);
+    });
+  });
+
+  describe('encode/decode round-trip', function () {
+    // The plugin's static/js/index.js wraps the target href with
+    // encodeURIComponent and the redirect template decodes once. This test
+    // pins down the property the fix relies on: round-tripping must be
+    // lossless for URLs containing percent-encoded characters that would
+    // otherwise be reinterpreted by a second decode pass.
+    const cases = [
+      // Issue #80 — Google Maps Plus Code (the original bug report).
+      'https://www.google.com/maps/place/G98H%2BG38%20Berlin%2C%20Deutschland',
+      // Common URL forms with reserved chars.
+      'https://example.com/path?q=a%20b&x=1%2B2',
+      'https://example.com/path/with%2Fslash',
+      'mailto:user@example.com?subject=Hello%20World',
+    ];
+    for (const url of cases) {
+      it(`preserves: ${url}`, function () {
+        const round = decodeURIComponent(encodeURIComponent(url));
+        assert.equal(round, url);
+      });
+    }
+  });
+});

package/templates/redirect.html

@@ -7,13 +7,22 @@
 <script type="text/javascript">
   window.redir_onload = function() {
     var urlhash = location.hash.substr(1);
-    if (urlhash.search(':') < 0) {
-      urlhash = unescape(urlhash);
-    }
 
     var the_content = document.getElementById('content');
     if (urlhash) {
-      urlhash = decodeURIComponent(urlhash);
+      // The link generator (static/js/index.js) wraps the target URL with
+      // encodeURIComponent, so a single decode restores it. Decoding twice
+      // (the previous behavior — see git history of issue #80) breaks any
+      // URL whose path or query contains percent-encoded characters that
+      // should stay encoded, e.g. Plus Codes like G98H%2BG38 in Google
+      // Maps URLs.
+      try {
+        urlhash = decodeURIComponent(urlhash);
+      } catch (e) {
+        // Malformed percent-sequence (e.g. manually-crafted URL). Fall
+        // through with the raw hash; the safe-scheme check below still
+        // protects against unknown schemes.
+      }
 
       // whitelist "safe" URL and URI schemes, and warn for others
       safe_regexp = /^(ftps?|https?):\/\/|(about|geo|mailto):/i;