LogalDeveloper/owncast
0
Fork 0
Code Activity

Prevent remote image injection with /img/emoji/ in url (#1245)

Browse Source 
* test remote img blocking with /img/emoji/ in url

* fix emoji filter

prevent injection of remote img with /img/emoji in url
This commit is contained in:
Meisam
2021-07-23 20:00:04 +02:00
committed by GitHub
parent ae78283caf
commit a8e93de134
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/chat/events/events.go
View File

@@ -139,7 +139,7 @@ func sanitize(raw string) string {
p.AllowElements("br", "p")
// Allow img tags from the the local emoji directory only
p.AllowAttrs("src").Matching(regexp.MustCompile(`(?i)/img/emoji`)).OnElements("img")
p.AllowAttrs("src").Matching(regexp.MustCompile(`(?i)^/img/emoji`)).OnElements("img")
p.AllowAttrs("alt", "title").Matching(regexp.MustCompile(`:\S+:`)).OnElements("img")
p.AllowAttrs("class").OnElements("img")