Something inspirational about @bob-der-baumeister and @jenny-rostock.
' +const contentEmptyMentions = + 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' +const contentWithPlainLinks = + 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' + describe('extractMentionedUsers', () => { describe('content undefined', () => { it('returns empty array', () => { @@ -7,53 +14,17 @@ describe('extractMentionedUsers', () => { }) }) - describe('searches through links', () => { - it('ignores links without .mention class', () => { - const content = - 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' - expect(extractMentionedUsers(content)).toEqual([]) - }) - - describe('given a link with .mention class', () => { - it('extracts ids', () => { - const content = - 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' - expect(extractMentionedUsers(content)).toEqual(['u2', 'u3']) - }) - - describe('handles links', () => { - it('with slug and id', () => { - const content = - 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' - expect(extractMentionedUsers(content)).toEqual(['u2', 'u3']) - }) - - it('with domains', () => { - const content = - 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' - expect(extractMentionedUsers(content)).toEqual(['u2', 'u3']) - }) - - it('special characters', () => { - const content = - 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' - expect(extractMentionedUsers(content)).toEqual(['u!*(),2', 'u.~-3']) - }) - }) + it('ignores links without .mention class', () => { + expect(extractMentionedUsers(contentWithPlainLinks)).toEqual([]) + }) - describe('does not crash if', () => { - it('`href` contains no user id', () => { - const content = - 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' - expect(extractMentionedUsers(content)).toEqual([]) - }) + describe('given a link with .mention class and `data-mention-id` attribute ', () => { + it('extracts ids', () => { + expect(extractMentionedUsers(contentWithMentions)).toEqual(['u3']) + }) - it('`href` is empty or invalid', () => { - const content = - 'Something inspirational about @bob-der-baumeister and @jenny-rostock.
' - expect(extractMentionedUsers(content)).toEqual([]) - }) - }) + it('ignores empty `data-mention-id` attributes', () => { + expect(extractMentionedUsers(contentEmptyMentions)).toEqual([]) }) }) }) diff --git a/backend/src/middleware/xssMiddleware.js b/backend/src/middleware/xssMiddleware.js index 6894e86015..f98ab9d619 100644 --- a/backend/src/middleware/xssMiddleware.js +++ b/backend/src/middleware/xssMiddleware.js @@ -2,30 +2,16 @@ import walkRecursive from '../helpers/walkRecursive' // import { getByDot, setByDot, getItems, replaceItems } from 'feathers-hooks-common' import sanitizeHtml from 'sanitize-html' // import { isEmpty, intersection } from 'lodash' -import cheerio from 'cheerio' import linkifyHtml from 'linkifyjs/html' -const embedToAnchor = content => { - const $ = cheerio.load(content) - $('div[data-url-embed]').each((i, el) => { - const url = el.attribs['data-url-embed'] - const aTag = $(`${url}`) - $(el).replaceWith(aTag) - }) - return $('body').html() -} - function clean(dirty) { if (!dirty) { return dirty } - // Convert embeds to a-tags - dirty = embedToAnchor(dirty) dirty = linkifyHtml(dirty) dirty = sanitizeHtml(dirty, { allowedTags: [ - 'iframe', 'img', 'p', 'h3', @@ -50,35 +36,24 @@ function clean(dirty) { a: ['href', 'class', 'target', 'data-*', 'contenteditable'], span: ['contenteditable', 'class', 'data-*'], img: ['src'], - iframe: ['src', 'class', 'frameborder', 'allowfullscreen'], }, allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'], parser: { lowerCaseTags: true, }, transformTags: { - iframe: function(tagName, attribs) { - return { - tagName: 'a', - text: attribs.src, - attribs: { - href: attribs.src, - target: '_blank', - 'data-url-embed': '', - }, - } - }, h1: 'h3', h2: 'h3', h3: 'h3', h4: 'h4', h5: 'strong', i: 'em', - a: function(tagName, attribs) { + a: (tagName, attribs) => { return { tagName: 'a', attribs: { - href: attribs.href, + ...attribs, + href: attribs.href || '', target: '_blank', rel: 'noopener noreferrer nofollow', }, @@ -86,33 +61,6 @@ function clean(dirty) { }, b: 'strong', s: 'strike', - img: function(tagName, attribs) { - const src = attribs.src - - if (!src) { - // remove broken images - return {} - } - - // if (isEmpty(hook.result)) { - // const config = hook.app.get('thumbor') - // if (config && src.indexOf(config < 0)) { - // // download image - // // const ThumborUrlHelper = require('../helper/thumbor-helper') - // // const Thumbor = new ThumborUrlHelper(config.key || null, config.url || null) - // // src = Thumbor - // // .setImagePath(src) - // // .buildUrl('740x0') - // } - // } - return { - tagName: 'img', - attribs: { - // TODO: use environment variables - src: `http://localhost:3050/images?url=${src}`, - }, - } - }, }, }) @@ -120,8 +68,6 @@ function clean(dirty) { dirty = dirty // remove all tags with "space only" .replace(/<[a-z-]+>[\s]+<\/[a-z-]+>/gim, '') - // remove all iframes - .replace(/(
+ Here is some italic, bold and underline text.
+
+ Also do we have some inline links here.
+
At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
+At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
+At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
+ +Also some list
with
several
points
justo
dolores
et ea rebum
kasd gubergren
+ Here you can mention people like + @sandra and others. + Try it out! +
+ `, + }), + template: `+ This text contains #hashtags for projects like #human-connection + Try to add more by typing #. +
+ `, + }), + template: `+ The following link should render a youtube video in addition to the link. +
+ + https://www.youtube.com/watch?v=qkdXAtO40Fo + + `, + }), + template: `