From b52782deb89cb030b0bca410dea9ddccb5635523 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Thu, 26 Dec 2013 21:10:26 -0500 Subject: [PATCH] removed use of strip_tags and using String library instead --- public/src/app.js | 11 ----------- public/src/modules/chat.js | 4 ++-- public/src/modules/string.js | 3 +++ public/src/utils.js | 12 ------------ src/posts.js | 5 +++-- src/topics.js | 3 ++- src/user.js | 3 ++- src/webserver.js | 2 +- src/websockets.js | 3 ++- 9 files changed, 15 insertions(+), 31 deletions(-) create mode 100644 public/src/modules/string.js diff --git a/public/src/app.js b/public/src/app.js index 2a76d2555a..437a017675 100644 --- a/public/src/app.js +++ b/public/src/app.js @@ -178,17 +178,6 @@ var socket, return text.replace(/(\d)(?=(\d\d\d)+(?!\d))/g, "$1,"); }; - // Willingly stolen from: http://phpjs.org/functions/strip_tags/ - app.strip_tags = function (input, allowed) { - allowed = (((allowed || "") + "").toLowerCase().match(/<[a-z][a-z0-9]*>/g) || []).join(''); // making sure the allowed arg is a string containing only tags in lowercase () - var tags = /<\/?([a-z][a-z0-9]*)\b[^>]*>/gi, - commentsAndPhpTags = /|<\?(?:php)?[\s\S]*?\?>/gi; - - return input.replace(commentsAndPhpTags, '').replace(tags, function ($0, $1) { - return allowed.indexOf('<' + $1.toLowerCase() + '>') > -1 ? $0 : ''; - }); - }; - // use unique alert_id to have multiple alerts visible at a time, use the same alert_id to fade out the current instance // type : error, success, info, warning/notify // title = bolded title text diff --git a/public/src/modules/chat.js b/public/src/modules/chat.js index 490f6e571b..17820dcadc 100644 --- a/public/src/modules/chat.js +++ b/public/src/modules/chat.js @@ -1,4 +1,4 @@ -define(['taskbar'], function(taskbar) { +define(['taskbar', 'string'], function(taskbar, S) { var module = {}; @@ -139,7 +139,7 @@ define(['taskbar'], function(taskbar) { } function sendMessage(chatModal) { - var msg = app.strip_tags(chatModal.find('#chat-message-input').val()); + var msg = S(chatModal.find('#chat-message-input').val()).stripTags().s; if(msg.length) { msg = msg +'\n'; socket.emit('api:chats.send', { touid:chatModal.touid, message:msg}); diff --git a/public/src/modules/string.js b/public/src/modules/string.js new file mode 100644 index 0000000000..d56334ffd7 --- /dev/null +++ b/public/src/modules/string.js @@ -0,0 +1,3 @@ +/* +string.js - Copyright (C) 2012-2013, JP Richardson +*/!function(){"use strict";function n(e,t){t!==null&&t!==undefined?typeof t=="string"?e.s=t:e.s=t.toString():e.s=t,e.orig=t,t!==null&&t!==undefined?e.__defineGetter__?e.__defineGetter__("length",function(){return e.s.length}):e.length=t.length:e.length=-1}function r(e){n(this,e)}function u(){for(var e in s)(function(e){var t=s[e];i.hasOwnProperty(e)||(o.push(e),i[e]=function(){return String.prototype.s=this,t.apply(this,arguments)})})(e)}function a(){for(var e=0;er?n.slice(s,i):"")},camelize:function(){var e=this.trim().s.replace(/(\-|_|\s)+(.)?/g,function(e,t,n){return n?n.toUpperCase():""});return new this.constructor(e)},capitalize:function(){return new this.constructor(this.s.substr(0,1).toUpperCase()+this.s.substring(1).toLowerCase())},charAt:function(e){return this.s.charAt(e)},chompLeft:function(e){var t=this.s;return t.indexOf(e)===0?(t=t.slice(e.length),new this.constructor(t)):this},chompRight:function(e){if(this.endsWith(e)){var t=this.s;return t=t.slice(0,t.length-e.length),new this.constructor(t)}return this},collapseWhitespace:function(){var e=this.s.replace(/[\s\xa0]+/g," ").replace(/^\s+|\s+$/g,"");return new this.constructor(e)},contains:function(e){return this.s.indexOf(e)>=0},count:function(e){var t=0,n=this.s.indexOf(e);while(n>=0)t+=1,n=this.s.indexOf(e,n+1);return t},dasherize:function(){var e=this.trim().s.replace(/[_\s]+/g,"-").replace(/([A-Z])/g,"-$1").replace(/-+/g,"-").toLowerCase();return new this.constructor(e)},decodeHtmlEntities:function(){var e=this.s;return e=e.replace(/&#(\d+);?/g,function(e,t){return String.fromCharCode(t)}).replace(/&#[xX]([A-Fa-f0-9]+);?/g,function(e,t){return String.fromCharCode(parseInt(t,16))}).replace(/&([^;\W]+;?)/g,function(e,n){var r=n.replace(/;$/,""),i=t[n]||n.match(/;$/)&&t[r];return typeof i=="number"?String.fromCharCode(i):typeof i=="string"?i:e}),new this.constructor(e)},endsWith:function(e){var t=this.s.length-e.length;return t>=0&&this.s.indexOf(e,t)===t},escapeHTML:function(){return new this.constructor(this.s.replace(/[&<>"']/g,function(e){return"&"+m[e]+";"}))},ensureLeft:function(e){var t=this.s;return t.indexOf(e)===0?this:new this.constructor(e+t)},ensureRight:function(e){var t=this.s;return this.endsWith(e)?this:new this.constructor(t+e)},humanize:function(){if(this.s===null||this.s===undefined)return new this.constructor("");var e=this.underscore().replace(/_id$/,"").replace(/_/g," ").trim().capitalize();return new this.constructor(e)},isAlpha:function(){return!/[^a-z\xC0-\xFF]/.test(this.s.toLowerCase())},isAlphaNumeric:function(){return!/[^0-9a-z\xC0-\xFF]/.test(this.s.toLowerCase())},isEmpty:function(){return this.s===null||this.s===undefined?!0:/^[\s\xa0]*$/.test(this.s)},isLower:function(){return this.isAlpha()&&this.s.toLowerCase()===this.s},isNumeric:function(){return!/[^0-9]/.test(this.s)},isUpper:function(){return this.isAlpha()&&this.s.toUpperCase()===this.s},left:function(e){if(e>=0){var t=this.s.substr(0,e);return new this.constructor(t)}return this.right(-e)},lines:function(){return this.replaceAll("\r\n","\n").s.split("\n")},pad:function(e,t){t==null&&(t=" ");if(this.s.length>=e)return new this.constructor(this.s);e-=this.s.length;var n=Array(Math.ceil(e/2)+1).join(t),r=Array(Math.floor(e/2)+1).join(t);return new this.constructor(n+this.s+r)},padLeft:function(e,t){return t==null&&(t=" "),this.s.length>=e?new this.constructor(this.s):new this.constructor(Array(e-this.s.length+1).join(t)+this.s)},padRight:function(e,t){return t==null&&(t=" "),this.s.length>=e?new this.constructor(this.s):new this.constructor(this.s+Array(e-this.s.length+1).join(t))},parseCSV:function(e,t,n,r){e=e||",",n=n||"\\",typeof t=="undefined"&&(t='"');var i=0,s=[],o=[],u=this.s.length,a=!1,f=this,l=function(e){return f.s.charAt(e)};if(typeof r!="undefined")var c=[];t||(a=!0);while(i=0){var t=this.s.substr(this.s.length-e,e);return new this.constructor(t)}return this.left(-e)},setValue:function(e){return n(this,e),this},slugify:function(){var e=(new r(this.s.replace(/[^\w\s-]/g,"").toLowerCase())).dasherize().s;return e.charAt(0)==="-"&&(e=e.substr(1)),new this.constructor(e)},startsWith:function(e){return this.s.lastIndexOf(e,0)===0},stripPunctuation:function(){return new this.constructor(this.s.replace(/[^\w\s]|_/g,"").replace(/\s+/g," "))},stripTags:function(){var e=this.s,t=arguments.length>0?arguments:[""];return d(t,function(t){e=e.replace(RegExp("]*>","gi"),"")}),new this.constructor(e)},template:function(e,t,n){var r=this.s,t=t||p.TMPL_OPEN,n=n||p.TMPL_CLOSE,i=t.replace(/[-[\]()*\s]/g,"\\$&").replace(/\$/g,"\\$"),s=n.replace(/[-[\]()*\s]/g,"\\$&").replace(/\$/g,"\\$"),o=new RegExp(i+"(.+?)"+s,"g"),u=r.match(o)||[];return u.forEach(function(i){var s=i.substring(t.length,i.length-n.length);typeof e[s]!="undefined"&&(r=r.replace(i,e[s]))}),new this.constructor(r)},times:function(e){return new this.constructor((new Array(e+1)).join(this.s))},toBoolean:function(){if(typeof this.orig=="string"){var e=this.s.toLowerCase();return e==="true"||e==="yes"||e==="on"}return this.orig===!0||this.orig===1},toFloat:function(e){var t=parseFloat(this.s);return e?parseFloat(t.toFixed(e)):t},toInt:function(){return/^\s*-?0x/i.test(this.s)?parseInt(this.s,16):parseInt(this.s,10)},trim:function(){var e;return typeof i.trim=="undefined"?e=this.s.replace(/(^\s*|\s*$)/g,""):e=this.s.trim(),new this.constructor(e)},trimLeft:function(){var e;return i.trimLeft?e=this.s.trimLeft():e=this.s.replace(/(^\s*)/g,""),new this.constructor(e)},trimRight:function(){var e;return i.trimRight?e=this.s.trimRight():e=this.s.replace(/\s+$/,""),new this.constructor(e)},truncate:function(e,t){var n=this.s;e=~~e,t=t||"...";if(n.length<=e)return new this.constructor(n);var i=function(e){return e.toUpperCase()!==e.toLowerCase()?"A":" "},s=n.slice(0,e+1).replace(/.(?=\W*\w*$)/g,i);return s.slice(s.length-2).match(/\w\w/)?s=s.replace(/\s*\S+$/,""):s=(new r(s.slice(0,s.length-1))).trimRight().s,(s+t).length>n.length?new r(n):new r(n.slice(0,s.length)+t)},toCSV:function(){function u(e){return e!==null&&e!==""}var e=",",t='"',n="\\",i=!0,s=!1,o=[];typeof arguments[0]=="object"?(e=arguments[0].delimiter||e,e=arguments[0].separator||e,t=arguments[0].qualifier||t,i=!!arguments[0].encloseNumbers,n=arguments[0].escape||n,s=!!arguments[0].keys):typeof arguments[0]=="string"&&(e=arguments[0]),typeof arguments[1]=="string"&&(t=arguments[1]),arguments[1]===null&&(t=null);if(this.orig instanceof Array)o=this.orig;else for(var a in this.orig)this.orig.hasOwnProperty(a)&&(s?o.push(a):o.push(this.orig[a]));var f=n+t,l=[];for(var c=0;c",quot:'"',apos:"'",amp:"&"},m={};for(var g in v)m[v[g]]=g;t={amp:"&",gt:">",lt:"<",quot:'"',apos:"'",AElig:198,Aacute:193,Acirc:194,Agrave:192,Aring:197,Atilde:195,Auml:196,Ccedil:199,ETH:208,Eacute:201,Ecirc:202,Egrave:200,Euml:203,Iacute:205,Icirc:206,Igrave:204,Iuml:207,Ntilde:209,Oacute:211,Ocirc:212,Ograve:210,Oslash:216,Otilde:213,Ouml:214,THORN:222,Uacute:218,Ucirc:219,Ugrave:217,Uuml:220,Yacute:221,aacute:225,acirc:226,aelig:230,agrave:224,aring:229,atilde:227,auml:228,ccedil:231,eacute:233,ecirc:234,egrave:232,eth:240,euml:235,iacute:237,icirc:238,igrave:236,iuml:239,ntilde:241,oacute:243,ocirc:244,ograve:242,oslash:248,otilde:245,ouml:246,szlig:223,thorn:254,uacute:250,ucirc:251,ugrave:249,uuml:252,yacute:253,yuml:255,copy:169,reg:174,nbsp:160,iexcl:161,cent:162,pound:163,curren:164,yen:165,brvbar:166,sect:167,uml:168,ordf:170,laquo:171,not:172,shy:173,macr:175,deg:176,plusmn:177,sup1:185,sup2:178,sup3:179,acute:180,micro:181,para:182,middot:183,cedil:184,ordm:186,raquo:187,frac14:188,frac12:189,frac34:190,iquest:191,times:215,divide:247,"OElig;":338,"oelig;":339,"Scaron;":352,"scaron;":353,"Yuml;":376,"fnof;":402,"circ;":710,"tilde;":732,"Alpha;":913,"Beta;":914,"Gamma;":915,"Delta;":916,"Epsilon;":917,"Zeta;":918,"Eta;":919,"Theta;":920,"Iota;":921,"Kappa;":922,"Lambda;":923,"Mu;":924,"Nu;":925,"Xi;":926,"Omicron;":927,"Pi;":928,"Rho;":929,"Sigma;":931,"Tau;":932,"Upsilon;":933,"Phi;":934,"Chi;":935,"Psi;":936,"Omega;":937,"alpha;":945,"beta;":946,"gamma;":947,"delta;":948,"epsilon;":949,"zeta;":950,"eta;":951,"theta;":952,"iota;":953,"kappa;":954,"lambda;":955,"mu;":956,"nu;":957,"xi;":958,"omicron;":959,"pi;":960,"rho;":961,"sigmaf;":962,"sigma;":963,"tau;":964,"upsilon;":965,"phi;":966,"chi;":967,"psi;":968,"omega;":969,"thetasym;":977,"upsih;":978,"piv;":982,"ensp;":8194,"emsp;":8195,"thinsp;":8201,"zwnj;":8204,"zwj;":8205,"lrm;":8206,"rlm;":8207,"ndash;":8211,"mdash;":8212,"lsquo;":8216,"rsquo;":8217,"sbquo;":8218,"ldquo;":8220,"rdquo;":8221,"bdquo;":8222,"dagger;":8224,"Dagger;":8225,"bull;":8226,"hellip;":8230,"permil;":8240,"prime;":8242,"Prime;":8243,"lsaquo;":8249,"rsaquo;":8250,"oline;":8254,"frasl;":8260,"euro;":8364,"image;":8465,"weierp;":8472,"real;":8476,"trade;":8482,"alefsym;":8501,"larr;":8592,"uarr;":8593,"rarr;":8594,"darr;":8595,"harr;":8596,"crarr;":8629,"lArr;":8656,"uArr;":8657,"rArr;":8658,"dArr;":8659,"hArr;":8660,"forall;":8704,"part;":8706,"exist;":8707,"empty;":8709,"nabla;":8711,"isin;":8712,"notin;":8713,"ni;":8715,"prod;":8719,"sum;":8721,"minus;":8722,"lowast;":8727,"radic;":8730,"prop;":8733,"infin;":8734,"ang;":8736,"and;":8743,"or;":8744,"cap;":8745,"cup;":8746,"int;":8747,"there4;":8756,"sim;":8764,"cong;":8773,"asymp;":8776,"ne;":8800,"equiv;":8801,"le;":8804,"ge;":8805,"sub;":8834,"sup;":8835,"nsub;":8836,"sube;":8838,"supe;":8839,"oplus;":8853,"otimes;":8855,"perp;":8869,"sdot;":8901,"lceil;":8968,"rceil;":8969,"lfloor;":8970,"rfloor;":8971,"lang;":9001,"rang;":9002,"loz;":9674,"spades;":9824,"clubs;":9827,"hearts;":9829,"diams;":9830}}.call(this); \ No newline at end of file diff --git a/public/src/utils.js b/public/src/utils.js index 9acc0594d9..7c8fb2fae9 100644 --- a/public/src/utils.js +++ b/public/src/utils.js @@ -123,18 +123,6 @@ isPasswordValid: function(password) { return password && password.indexOf(' ') === -1; }, - - // Blatently stolen from: http://phpjs.org/functions/strip_tags/ - 'strip_tags': function(input, allowed) { - allowed = (((allowed || "") + "").toLowerCase().match(/<[a-z][a-z0-9]*>/g) || []).join(''); // making sure the allowed arg is a string containing only tags in lowercase () - var tags = /<\/?([a-z][a-z0-9]*)\b[^>]*>/gi, - commentsAndPhpTags = /|<\?(?:php)?[\s\S]*?\?>/gi; - - return input.replace(commentsAndPhpTags, '').replace(tags, function($0, $1) { - return allowed.indexOf('<' + $1.toLowerCase() + '>') > -1 ? $0 : ''; - }); - }, - buildMetaTags: function(tagsArr) { var tags = '', tag; diff --git a/src/posts.js b/src/posts.js index 56ce12453b..033168f030 100644 --- a/src/posts.js +++ b/src/posts.js @@ -15,7 +15,8 @@ var db = require('./database'), nconf = require('nconf'), validator = require('validator'), winston = require('winston'), - gravatar = require('gravatar'); + gravatar = require('gravatar'), + S = require('string'); (function(Posts) { var customUserInfo = {}; @@ -294,7 +295,7 @@ var db = require('./database'), } if(stripTags) { - postData.content = utils.strip_tags(content); + postData.content = S(content).stripTags().s; } else { postData.content = content; } diff --git a/src/topics.js b/src/topics.js index 4efe8c002a..8fffcedbdf 100644 --- a/src/topics.js +++ b/src/topics.js @@ -2,6 +2,7 @@ var async = require('async'), gravatar = require('gravatar'), nconf = require('nconf'), validator = require('validator'), + S = require('string'), db = require('./database'), posts = require('./posts'), @@ -826,7 +827,7 @@ var async = require('async'), if (postData.content) { stripped = postData.content.replace(/>.+\n\n/, ''); postTools.parse(stripped, function(err, stripped) { - returnObj.text = utils.strip_tags(stripped); + returnObj.text = S(stripped).stripTags().s; callback(null, returnObj); }); } else { diff --git a/src/user.js b/src/user.js index 5743c62c57..d472b12e90 100644 --- a/src/user.js +++ b/src/user.js @@ -6,6 +6,7 @@ var bcrypt = require('bcrypt'), gravatar = require('gravatar'), check = require('validator').check, sanitize = require('validator').sanitize, + S = require('string'), utils = require('./../public/src/utils'), plugins = require('./plugins'), @@ -266,7 +267,7 @@ var bcrypt = require('bcrypt'), }); return; } else if (field === 'signature') { - data[field] = utils.strip_tags(data[field]); + data[field] = S(data[field]).stripTags().s; } else if (field === 'website') { if(data[field].substr(0, 7) !== 'http://' && data[field].substr(0, 8) !== 'https://') { data[field] = 'http://' + data[field]; diff --git a/src/webserver.js b/src/webserver.js index 04426b1a0a..0ac8e00fe7 100644 --- a/src/webserver.js +++ b/src/webserver.js @@ -510,7 +510,7 @@ var path = require('path'), var lastMod = 0, sanitize = validator.sanitize, description = (function() { - var content = S(topicData.posts[0].content).stripTags(); + var content = S(topicData.posts[0].content).stripTags().s; if (content.length > 255) { content = content.substr(0, 255) + '...'; diff --git a/src/websockets.js b/src/websockets.js index 74c9dc163a..9a9d0700d4 100644 --- a/src/websockets.js +++ b/src/websockets.js @@ -8,6 +8,7 @@ var cookie = require('cookie'), nconf = require('nconf'), gravatar = require('gravatar'), winston = require('winston'), + S = require('string'), db = require('./database'), @@ -712,7 +713,7 @@ websockets.init = function(io) { return; } - var msg = utils.strip_tags(data.message); + var msg = S(data.message).stripTags().s; user.getMultipleUserFields([uid, touid], ['username'], function(err, usersData) { if(err) {