d3v1l/matrixion
1
0
Fork 0
mirror of https://github.com/Nheko-Reborn/nheko.git synced 2024-11-26 04:58:49 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Attribute values can contain slashes

Browse source
This commit is contained in:
Nicolas Werner 2022-09-04 18:14:14 +02:00
parent e144c5741f
commit c6bf1e6508
No known key found for this signature in database
GPG key ID: C8D75E610773F2D9
1 changed files with 16 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
src/Utils.cpp
View file

@ -433,6 +433,7 @@ utils::escapeBlacklistedHtml(const QString &rawStr)
"details", "/details", "summary", "/summary"}; "details", "/details", "summary", "/summary"};
constexpr static const std::array tagNameEnds = {' ', '>'}; constexpr static const std::array tagNameEnds = {' ', '>'};
constexpr static const std::array attrNameEnds = {' ', '>', '=', '\t', '\r', '\n', '/', '\f'}; constexpr static const std::array attrNameEnds = {' ', '>', '=', '\t', '\r', '\n', '/', '\f'};
constexpr static const std::array attrValueEnds = {' ', '\t', '\r', '\n', '\f', '>'};
constexpr static const std::array spaceChars = {' ', '\t', '\r', '\n', '\f'}; constexpr static const std::array spaceChars = {' ', '\t', '\r', '\n', '\f'};
QByteArray data = rawStr.toUtf8(); QByteArray data = rawStr.toUtf8();
@ -535,16 +536,22 @@ utils::escapeBlacklistedHtml(const QString &rawStr)
continue; continue;
} }
} else { } else {
attrStart += 1;
auto valueEnd = std::find_first_of(attrStart, auto valueEnd = std::find_first_of(attrStart,
attrsEnd, attrsEnd,
attrNameEnds.begin(), attrValueEnds.begin(),
attrNameEnds.end()); attrValueEnds.end());
auto val =
sanitizeValue(QByteArray(attrStart, valueEnd - attrStart));
attrStart = consumeSpaces(valueEnd);
if (val.contains('"'))
continue;
buffer.append(' '); buffer.append(' ');
buffer.append(attrName); buffer.append(attrName);
buffer.append("="); buffer.append("=\"");
buffer.append(attrStart, valueEnd - attrStart); buffer.append(val);
attrStart = valueEnd; buffer.append('"');
continue; continue;
} }
} }