mettags: limit the scope of url => metatag to http, https and / links.

- prevent of malicious injection of JS links and other unsafe types

rhodecode/lib/helpers.py

@@ -947,8 +947,8 @@ tags_paterns = OrderedDict((
     ('see', (re.compile(r'\[see\ \=\>\ *([a-zA-Z0-9\/\=\?\&\ \:\/\.\-]*)\]'),
             '<div class="metatag" tag="see">see: \\1 </div>')),
 
-    ('url', (re.compile(r'\[url\ \=\&gt;\ \[([a-zA-Z0-9\ \.\-\_]+)\]\((.*?)\)\]'),
-            '<div class="metatag" tag="url"> <a href="\\2">\\1</a> </div>')),
+    ('url', (re.compile(r'\[url\ \=\&gt;\ \[([a-zA-Z0-9\ \.\-\_]+)\]\((http://|https://|/)(.*?)\)\]'),
+            '<div class="metatag" tag="url"> <a href="\\2\\3">\\1</a> </div>')),
 
     ('license', (re.compile(r'\[license\ \=\&gt;\ *([a-zA-Z0-9\/\=\?\&amp;\ \:\/\.\-]*)\]'),
                 '<div class="metatag" tag="license"><a href="http:\/\/www.opensource.org/licenses/\\1">\\1</a></div>')),

rhodecode/tests/lib/test_libs.py

@@ -237,6 +237,19 @@ def test_age_in_future(age_args, expected, kw, baseapp):
         ('url', '[url => [name](http://rc.com)]'),
      ]),
     # entry
+    ((
+            "[url => [linkNameJS](javascript:alert(document.domain))]\n"
+            "[url => [linkNameHTTP](http://rhodecode.com)]\n"
+            "[url => [linkNameHTTPS](https://rhodecode.com)]\n"
+            "[url => [linkNamePath](/repo_group)]\n"
+     ),
+     [
+         ('generic', '[linkNameJS]'),
+         ('url', '[url => [linkNameHTTP](http://rhodecode.com)]'),
+         ('url', '[url => [linkNameHTTPS](https://rhodecode.com)]'),
+         ('url', '[url => [linkNamePath](/repo_group)]'),
+     ]),
+    # entry
     ((
         "hello pta[tag] gog [[]] [[] sda ero[or]d [me =&gt;>< sa]"
         "[requires] [stale] [see<>=&gt;] [see =&gt; http://url.com]"