Remove more <script>

KDE · Sep 29, 2016 · 7797658 · 7797658
1 parent a874479
commit 7797658
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/messageviewer/src/htmlwriter/autotests/webengineparthtmlwritertest.cpp b/messageviewer/src/htmlwriter/autotests/webengineparthtmlwritertest.cpp
@@ -39,6 +39,9 @@ void WebEnginePartHtmlWriterTest::removeScriptInHtml_data()
     QTest::newRow("onescript") << QStringLiteral("<a>boo<script>alert(1)</script></a>") << QStringLiteral("<a>boo</a>");
     QTest::newRow("onescriptwithattribute") << QStringLiteral("<a>boo<script type=\"foo\">alert(1)</script></a>") << QStringLiteral("<a>boo</a>");
     QTest::newRow("severalscriptwithattribute") << QStringLiteral("<p>foo</p><script>a</script><a>boo<script type=\"foo\">alert(1)</script></a>") << QStringLiteral("<p>foo</p><a>boo</a>");
+    //Need to fix it/.QTest::newRow("multiline") << QStringLiteral("<script>\nalert(1)</script>") << QString();
+    QTest::newRow("scriptwithspace") << QStringLiteral("<a>boo<script type=\"foo\" >alert(1)</script ></a>") << QStringLiteral("<a>boo</a>");
+    QTest::newRow("scriptwithremoveaccess") << QStringLiteral("<a>boo<script src=\"http://foo\"/></a>") << QStringLiteral("<a>boo</a>");
     QTest::newRow("empty") << QString() << QString();
 }
 

diff --git a/messageviewer/src/htmlwriter/webengineparthtmlwriter.cpp b/messageviewer/src/htmlwriter/webengineparthtmlwriter.cpp
@@ -74,8 +74,13 @@ void WebEnginePartHtmlWriter::end()
 
 QString WebEnginePartHtmlWriter::removeJscripts(QString str)
 {
-    const QRegularExpression reg(QStringLiteral("<script[^>]*>.*?</script>"));
-    return str.remove(reg);
+    //Remove regular <script>...</script>
+    const QRegularExpression regScript(QStringLiteral("<script[^>]*>.*?</script\\s*>"));
+    str = str.remove(regScript);
+    //Remove string as <script src=http://.../>
+    const QRegularExpression regScript2(QStringLiteral("<script[^>]*/>"));
+    str = str.remove(regScript2);
+    return str;
 }
 
 void WebEnginePartHtmlWriter::reset()