eliseuamaro/gnu-social
1
0
Fork 0
forked from GNUsocial/gnu-social
Code Issues Pull Requests Releases Wiki Activity

Merge branch 'oembed_branch' into 'nightly'

Browse Source 
purify oembed html and don't allow cdata

hopefully we never need stuff in cdata

reason for this is that this link serves javascript in its oembed data: https://www.maketecheasier.com/switch-windows-10-to-linux/

see:
https://www.maketecheasier.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.maketecheasier.com%2Fswitch-windows-10-to-linux%2F

i don't feel we want that in our database.  

See merge request !79
This commit is contained in:
mmn 2016-01-15 13:11:35 +00:00
commit 44c10bb2aa
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/util.php
View File

@ -581,7 +581,8 @@ function common_purify($html)
$config = array('safe' => 1, // means that elements=* means elements=*-applet-embed-iframe-object-script or so
'elements' => '*',
'deny_attribute' => 'id,style,on*');
'deny_attribute' => 'id,style,on*',
'cdata' => 1);
// Remove more elements than what the 'safe' filter gives (elements must be '*' before this)
// http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s3.6

12
plugins/Oembed/lib/oembedhelper.php
View File

@ -158,7 +158,15 @@ class oEmbedHelper
if(isset($key)) {
$params['key'] = common_config('oembed','apikey');
}
return HTTPClient::quickGetJson($api, $params);
$oembed_data = HTTPClient::quickGetJson($api, $params);
// purify html
if(isset($oembed_data->html)) {
$oembed_data->html = common_purify($oembed_data->html);
}
return $oembed_data;
}
/**
@ -211,4 +219,4 @@ class oEmbedHelper_DiscoveryException extends oEmbedHelper_Exception
{
return parent::__construct('No oEmbed discovery data.', 0, $previous);
}
}
}