From 746948ab8dd55b39ff2a4b673296267725fb4cdc Mon Sep 17 00:00:00 2001
From: Marcin Kuzminski <marcin@rhodecode.com>
Date: Mon, 20 Nov 2017 12:44:07 +0100
Subject: [PATCH] mettags: limit the scope of url => metatag to http, https and
 / links.

- prevent of malicious injection of JS links and other unsafe types
---
 rhodecode/lib/helpers.py         |  4 ++--
 rhodecode/tests/lib/test_libs.py | 13 +++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/rhodecode/lib/helpers.py b/rhodecode/lib/helpers.py
index f36c5612..5cd65c80 100644
--- a/rhodecode/lib/helpers.py
+++ b/rhodecode/lib/helpers.py
@@ -960,8 +960,8 @@ tags_paterns = OrderedDict((
     ('see', (re.compile(r'\[see\ \=\&gt;\ *([a-zA-Z0-9\/\=\?\&amp;\ \:\/\.\-]*)\]'),
             '<div class="metatag" tag="see">see: \\1 </div>')),
 
-    ('url', (re.compile(r'\[url\ \=\&gt;\ \[([a-zA-Z0-9\ \.\-\_]+)\]\((.*?)\)\]'),
-            '<div class="metatag" tag="url"> <a href="\\2">\\1</a> </div>')),
+    ('url', (re.compile(r'\[url\ \=\&gt;\ \[([a-zA-Z0-9\ \.\-\_]+)\]\((http://|https://|/)(.*?)\)\]'),
+            '<div class="metatag" tag="url"> <a href="\\2\\3">\\1</a> </div>')),
 
     ('license', (re.compile(r'\[license\ \=\&gt;\ *([a-zA-Z0-9\/\=\?\&amp;\ \:\/\.\-]*)\]'),
                 '<div class="metatag" tag="license"><a href="http:\/\/www.opensource.org/licenses/\\1">\\1</a></div>')),
diff --git a/rhodecode/tests/lib/test_libs.py b/rhodecode/tests/lib/test_libs.py
index 1bb22732..f72f9690 100644
--- a/rhodecode/tests/lib/test_libs.py
+++ b/rhodecode/tests/lib/test_libs.py
@@ -237,6 +237,19 @@ def test_age_in_future(age_args, expected, kw, pylonsapp):
         ('url', '[url =&gt; [name](http://rc.com)]'),
      ]),
     # entry
+    ((
+            "[url =&gt; [linkNameJS](javascript:alert(document.domain))]\n"
+            "[url =&gt; [linkNameHTTP](http://rhodecode.com)]\n"
+            "[url =&gt; [linkNameHTTPS](https://rhodecode.com)]\n"
+            "[url =&gt; [linkNamePath](/repo_group)]\n"
+     ),
+     [
+         ('generic', '[linkNameJS]'),
+         ('url', '[url =&gt; [linkNameHTTP](http://rhodecode.com)]'),
+         ('url', '[url =&gt; [linkNameHTTPS](https://rhodecode.com)]'),
+         ('url', '[url =&gt; [linkNamePath](/repo_group)]'),
+     ]),
+    # entry
     ((
         "hello pta[tag] gog [[]] [[] sda ero[or]d [me =&gt;>< sa]"
         "[requires] [stale] [see<>=&gt;] [see =&gt; http://url.com]"