Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow data urls #2833

Merged
merged 5 commits into from Apr 22, 2024
Merged

Allow data urls #2833

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cf32a8d
Allow data urls
T4rk1n Apr 16, 2024
54dfda3
Merge branch 'dev' into fix/xss-data-url
T4rk1n Apr 16, 2024
35c847b
Add more xss tests
T4rk1n Apr 16, 2024
3432eac
Merge branch 'dev' into fix/xss-data-url
T4rk1n Apr 19, 2024
30e2755
Update changelog
T4rk1n Apr 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 0 additions & 11 deletions components/dash-core-components/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 5 additions & 4 deletions components/dash-core-components/package.json
View file
Open in desktop
Expand Up @@ -35,7 +35,6 @@
"maintainer": "Alex Johnson <alex@plotly.com>",
"license": "MIT",
"dependencies": {
"@braintree/sanitize-url": "^7.0.0",
"@fortawesome/fontawesome-svg-core": "1.2.36",
"@fortawesome/free-regular-svg-icons": "^5.15.4",
"@fortawesome/free-solid-svg-icons": "^5.15.4",
Expand Down Expand Up @@ -87,13 +86,15 @@
"react": "^16.14.0",
"react-dom": "^16.14.0",
"react-jsx-parser": "1.21.0",
"rimraf": "^5.0.5",
"style-loader": "^3.3.3",
"styled-jsx": "^3.4.4",
"webpack": "^5.90.3",
"webpack-cli": "^5.1.4",
"rimraf": "^5.0.5"
"webpack-cli": "^5.1.4"
},
"optionalDependencies": {
"fsevents": "*"
},
"optionalDependencies": { "fsevents": "*" },
"files": [
"/dash_core_components/*{.js,.map}",
"/lib/"
Expand Down
4 changes: 2 additions & 2 deletions components/dash-core-components/src/components/Link.react.js
View file
Open in desktop
@@ -1,7 +1,6 @@
import PropTypes from 'prop-types';

import React, {useEffect, useMemo} from 'react';
import {sanitizeUrl} from '@braintree/sanitize-url';
import {isNil} from 'ramda';

/*
Expand Down Expand Up @@ -46,8 +45,9 @@ const Link = props => {
refresh,
setProps,
} = props;
const cleanUrl = window.dash_clientside.clean_url;
const sanitizedUrl = useMemo(() => {
return href ? sanitizeUrl(href) : undefined;
return href ? cleanUrl(href) : undefined;
}, [href]);

const updateLocation = e => {
Expand Down
11 changes: 0 additions & 11 deletions components/dash-html-components/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 5 additions & 6 deletions components/dash-html-components/package.json
View file
Open in desktop
Expand Up @@ -28,7 +28,6 @@
"author": "Chris Parmer <chris@plotly.com>",
"maintainer": "Alex Johnson <alex@plotly.com>",
"dependencies": {
"@braintree/sanitize-url": "^7.0.0",
"prop-types": "^15.8.1",
"ramda": "^0.29.0"
},
Expand All @@ -44,16 +43,16 @@
"eslint": "^8.41.0",
"eslint-plugin-import": "^2.27.5",
"eslint-plugin-react": "^7.32.2",
"mkdirp": "^0.5.1",
"npm-run-all": "^4.1.5",
"react": "^16.14.0",
"react-docgen": "^5.4.3",
"react-dom": "^16.14.0",
"request": "^2.88.2",
"rimraf": "^5.0.5",
"string": "^3.3.3",
"webpack": "^5.90.3",
"webpack-cli": "^5.1.4",
"react": "^16.14.0",
"react-dom": "^16.14.0",
"rimraf": "^5.0.5",
"mkdirp": "^0.5.1"
"webpack-cli": "^5.1.4"
},
"files": [
"/dash_html_components/*{.js,.map}"
Expand Down
12 changes: 3 additions & 9 deletions components/dash-html-components/scripts/generate-components.js
View file
Open in desktop
Expand Up @@ -249,18 +249,12 @@ const customDocs = {
* <body>.`
};

const customImportsForComponents = {
a: `import {sanitizeUrl} from '@braintree/sanitize-url';`,
form: `import {sanitizeUrl} from '@braintree/sanitize-url';`,
iframe: `import {sanitizeUrl} from '@braintree/sanitize-url';`,
object: `import {sanitizeUrl} from '@braintree/sanitize-url';`,
embed: `import {sanitizeUrl} from '@braintree/sanitize-url';`,
button: `import {sanitizeUrl} from '@braintree/sanitize-url';`,
}
const customImportsForComponents = {};

function createXSSProtection(propName) {
return `
const ${propName} = React.useMemo(() => props.${propName} && sanitizeUrl(props.${propName}), [props.${propName}]);
const cleanUrl = window.dash_clientside.clean_url;
const ${propName} = React.useMemo(() => props.${propName} && cleanUrl(props.${propName}), [props.${propName}]);

if (${propName}) {
extraProps.${propName} = ${propName};
Expand Down
24 changes: 24 additions & 0 deletions dash/dash-renderer/src/utils/clientsideFunctions.ts
View file
Open in desktop
Expand Up @@ -18,6 +18,30 @@ const set_props = (id: string | object, props: {[k: string]: any}) => {
}
};

// Clean url code adapted from https://github.com/braintree/sanitize-url/blob/main/src/constants.ts
// to allow for data protocol.
const invalidProtocols = /^([^\w]*)(javascript|vbscript)/im;
const newLines = /&(tab|newline);/gi;

// eslint-disable-next-line no-control-regex
const ctrlChars = /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim;
const htmlEntities = /&#(\w+)(^\w|;)?/g;

const clean_url = (url: string, fallback = 'about:blank') => {
if (url === '') {
return url;
}
const cleaned = url
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to include the decodeHtmlCharacters step as in braintree/sanitize-url?

.replace(newLines, '')
.replace(ctrlChars, '')
.replace(htmlEntities, '');
if (invalidProtocols.test(cleaned)) {
return fallback;
}
return url;
};

const dc = ((window as any).dash_clientside =
(window as any).dash_clientside || {});
dc['set_props'] = set_props;
dc['clean_url'] = dc['clean_url'] === undefined ? clean_url : dc['clean_url'];