Resolves OSQA-674, be sure that we remove all anchors that trigger JavaScript code.

[osqa.git] / forum / skins / default / media / js / wmd / showdown.js

diff --git a/forum/skins/default/media/js/wmd/showdown.js b/forum/skins/default/media/js/wmd/showdown.js
index 0efa6c5ecd93b14318ff292c434abf9e902e35ac..b890fa8d3735803dcba6e55cc5cc167bb8bbf082 100644 (file)
--- a/forum/skins/default/media/js/wmd/showdown.js
+++ b/forum/skins/default/media/js/wmd/showdown.js
@@ -192,7 +192,7 @@ var _StripLinkDefinitions = function(text) {
                        } else if (m4) {
                                g_titles[m1] = m4.replace(/"/g,""");
                        }
                        } else if (m4) {
                                g_titles[m1] = m4.replace(/"/g,""");
                        }

-                       
+

                        // Completely remove the definition from the text
                        return "";
                }
                        // Completely remove the definition from the text
                        return "";
                }


@@ -264,7 +264,7 @@ var _HashHTMLBlocks = function(text) {
        text = text.replace(/^(<(p|div|h[1-6]|blockquote|pre|table|dl|ol|ul|script|noscript|form|fieldset|iframe|math)\b[^\r]*?.*<\/\2>[ \t]*(?=\n+)\n)/gm,hashElement);
 
        // Special case just for <hr />. It was easier to make a special case than
        text = text.replace(/^(<(p|div|h[1-6]|blockquote|pre|table|dl|ol|ul|script|noscript|form|fieldset|iframe|math)\b[^\r]*?.*<\/\2>[ \t]*(?=\n+)\n)/gm,hashElement);
 
        // Special case just for <hr />. It was easier to make a special case than

-       // to make the other regex more complicated.  
+       // to make the other regex more complicated.

 
        /*
                text = text.replace(/
 
        /*
                text = text.replace(/


@@ -273,7 +273,7 @@ var _HashHTMLBlocks = function(text) {
                        [ ]{0,3}
                        (<(hr)                          // start tag = $2
                        \b                                      // word break
                        [ ]{0,3}
                        (<(hr)                          // start tag = $2
                        \b                                      // word break

-                       ([^<>])*?                       // 
+                       ([^<>])*?                       //

                        \/?>)                           // the matching end tag
                        [ \t]*
                        (?=\n{2,})                      // followed by a blank line
                        \/?>)                           // the matching end tag
                        [ \t]*
                        (?=\n{2,})                      // followed by a blank line


@@ -331,13 +331,13 @@ var hashElement = function(wholeMatch,m1) {
        // Undo double lines
        blockText = blockText.replace(/\n\n/g,"\n");
        blockText = blockText.replace(/^\n/,"");
        // Undo double lines
        blockText = blockText.replace(/\n\n/g,"\n");
        blockText = blockText.replace(/^\n/,"");

-       
+

        // strip trailing blank lines
        blockText = blockText.replace(/\n+$/g,"");
        // strip trailing blank lines
        blockText = blockText.replace(/\n+$/g,"");

-       
+

        // Replace the element text with a marker ("~KxK" where x is its key)
        blockText = "\n\n~K" + (g_html_blocks.push(blockText)-1) + "K\n\n";
        // Replace the element text with a marker ("~KxK" where x is its key)
        blockText = "\n\n~K" + (g_html_blocks.push(blockText)-1) + "K\n\n";

-       
+

        return blockText;
 };
 
        return blockText;
 };
 


@@ -403,7 +403,7 @@ var _EscapeSpecialCharsWithinTagAttributes = function(text) {
 // don't conflict with their use in Markdown for code, italics and strong.
 //
 
 // don't conflict with their use in Markdown for code, italics and strong.
 //
 

-       // Build a regex to find HTML tags and comments.  See Friedl's 
+       // Build a regex to find HTML tags and comments.  See Friedl's

        // "Mastering Regular Expressions", 2nd Ed., pp. 200-201.
        var regex = /(<[a-z\/!$]("[^"]*"|'[^']*'|[^'">])*>|<!(--.*?--\s*)+>)/gi;
 
        // "Mastering Regular Expressions", 2nd Ed., pp. 200-201.
        var regex = /(<[a-z\/!$]("[^"]*"|'[^']*'|[^'">])*>|<!(--.*?--\s*)+>)/gi;
 


@@ -498,6 +498,11 @@ var _DoAnchors = function(text) {
        */
        text = text.replace(/(\[([^\[\]]+)\])()()()()()/g, writeAnchorTag);
 
        */
        text = text.replace(/(\[([^\[\]]+)\])()()()()()/g, writeAnchorTag);
 

+    // Prevent executing JavaScript from the Anchor href.
+    text = text.replace(/(<a.*href=[\"|\']javascript\:([^"]+)[\"|\'].*>([^<]+)<\/a>)/g, function() {
+        return arguments[3];
+    });
+

        return text;
 }
 
        return text;
 }
 


@@ -508,14 +513,14 @@ var writeAnchorTag = function(wholeMatch,m1,m2,m3,m4,m5,m6,m7) {
        var link_id      = m3.toLowerCase();
        var url         = m4;
        var title       = m7;
        var link_id      = m3.toLowerCase();
        var url         = m4;
        var title       = m7;

-       
+

        if (url == "") {
                if (link_id == "") {
                        // lower-case and turn embedded newlines into spaces
                        link_id = link_text.toLowerCase().replace(/ ?\n/g," ");
                }
                url = "#"+link_id;
        if (url == "") {
                if (link_id == "") {
                        // lower-case and turn embedded newlines into spaces
                        link_id = link_text.toLowerCase().replace(/ ?\n/g," ");
                }
                url = "#"+link_id;

-               
+

                if (g_urls[link_id] != undefined) {
                        url = g_urls[link_id];
                        if (g_titles[link_id] != undefined) {
                if (g_urls[link_id] != undefined) {
                        url = g_urls[link_id];
                        if (g_titles[link_id] != undefined) {


@@ -530,19 +535,19 @@ var writeAnchorTag = function(wholeMatch,m1,m2,m3,m4,m5,m6,m7) {
                                return whole_match;
                        }
                }
                                return whole_match;
                        }
                }

-       }       
-       
+       }
+

        url = escapeCharacters(url,"*_");
        var result = "<a href=\"" + url + "\"";
        url = escapeCharacters(url,"*_");
        var result = "<a href=\"" + url + "\"";

-       
+

        if (title != "") {
                title = title.replace(/"/g,"&quot;");
                title = escapeCharacters(title,"*_");
                result +=  " title=\"" + title + "\"";
        }
        if (title != "") {
                title = title.replace(/"/g,"&quot;");
                title = escapeCharacters(title,"*_");
                result +=  " title=\"" + title + "\"";
        }

-       
+

        result += ">" + link_text + "</a>";
        result += ">" + link_text + "</a>";

-       
+

        return result;
 }
 
        return result;
 }
 


@@ -613,14 +618,14 @@ var writeImageTag = function(wholeMatch,m1,m2,m3,m4,m5,m6,m7) {
        var title       = m7;
 
        if (!title) title = "";
        var title       = m7;
 
        if (!title) title = "";

-       
+

        if (url == "") {
                if (link_id == "") {
                        // lower-case and turn embedded newlines into spaces
                        link_id = alt_text.toLowerCase().replace(/ ?\n/g," ");
                }
                url = "#"+link_id;
        if (url == "") {
                if (link_id == "") {
                        // lower-case and turn embedded newlines into spaces
                        link_id = alt_text.toLowerCase().replace(/ ?\n/g," ");
                }
                url = "#"+link_id;

-               
+

                if (g_urls[link_id] != undefined) {
                        url = g_urls[link_id];
                        if (g_titles[link_id] != undefined) {
                if (g_urls[link_id] != undefined) {
                        url = g_urls[link_id];
                        if (g_titles[link_id] != undefined) {


@@ -630,10 +635,13 @@ var writeImageTag = function(wholeMatch,m1,m2,m3,m4,m5,m6,m7) {
                else {
                        return whole_match;
                }
                else {
                        return whole_match;
                }

-       }       
-       
+       }
+

        alt_text = alt_text.replace(/"/g,"&quot;");
        url = escapeCharacters(url,"*_");
        alt_text = alt_text.replace(/"/g,"&quot;");
        url = escapeCharacters(url,"*_");

+    if (url.toString().indexOf('http://') != 0 && url.toString().indexOf('https://') != 0) {
+        url = scriptUrl + url
+    }

        var result = "<img src=\"" + url + "\" alt=\"" + alt_text + "\"";
 
        // attacklab: Markdown.pl adds empty title attributes to images.
        var result = "<img src=\"" + url + "\" alt=\"" + alt_text + "\"";
 
        // attacklab: Markdown.pl adds empty title attributes to images.


@@ -644,9 +652,9 @@ var writeImageTag = function(wholeMatch,m1,m2,m3,m4,m5,m6,m7) {
                title = escapeCharacters(title,"*_");
                result +=  " title=\"" + title + "\"";
        //}
                title = escapeCharacters(title,"*_");
                result +=  " title=\"" + title + "\"";
        //}

-       
+

        result += " />";
        result += " />";

-       
+

        return result;
 }
 
        return result;
 }
 


@@ -656,7 +664,7 @@ var _DoHeaders = function(text) {
        // Setext-style headers:
        //      Header 1
        //      ========
        // Setext-style headers:
        //      Header 1
        //      ========

-       //  
+       //

        //      Header 2
        //      --------
        //
        //      Header 2
        //      --------
        //


@@ -740,7 +748,7 @@ var _DoLists = function(text) {
                        // paragraph for the last item in a list, if necessary:
                        list = list.replace(/\n{2,}/g,"\n\n\n");;
                        var result = _ProcessListItems(list);
                        // paragraph for the last item in a list, if necessary:
                        list = list.replace(/\n{2,}/g,"\n\n\n");;
                        var result = _ProcessListItems(list);

-       
+

                        // Trim any trailing whitespace, to put the closing `</$list_type>`
                        // up on the preceding line, to get it past the current stupid
                        // HTML block parser. This is a hack to work around the terrible
                        // Trim any trailing whitespace, to put the closing `</$list_type>`
                        // up on the preceding line, to get it past the current stupid
                        // HTML block parser. This is a hack to work around the terrible


@@ -760,7 +768,7 @@ var _DoLists = function(text) {
                        // paragraph for the last item in a list, if necessary:
                        var list = list.replace(/\n{2,}/g,"\n\n\n");;
                        var result = _ProcessListItems(list);
                        // paragraph for the last item in a list, if necessary:
                        var list = list.replace(/\n{2,}/g,"\n\n\n");;
                        var result = _ProcessListItems(list);

-                       result = runup + "<"+list_type+">\n" + result + "</"+list_type+">\n";   
+                       result = runup + "<"+list_type+">\n" + result + "</"+list_type+">\n";

                        return result;
                });
        }
                        return result;
                });
        }


@@ -846,7 +854,7 @@ _ProcessListItems = function(list_str) {
 var _DoCodeBlocks = function(text) {
 //
 //  Process Markdown `<pre><code>` blocks.
 var _DoCodeBlocks = function(text) {
 //
 //  Process Markdown `<pre><code>` blocks.

-//  
+//

 
        /*
                text = text.replace(text,
 
        /*
                text = text.replace(text,


@@ -863,12 +871,12 @@ var _DoCodeBlocks = function(text) {
 
        // attacklab: sentinel workarounds for lack of \A and \Z, safari\khtml bug
        text += "~0";
 
        // attacklab: sentinel workarounds for lack of \A and \Z, safari\khtml bug
        text += "~0";

-       
+

        text = text.replace(/(?:\n\n|^)((?:(?:[ ]{4}|\t).*\n+)+)(\n*[ ]{0,3}[^ \t\n]|(?=~0))/g,
                function(wholeMatch,m1,m2) {
                        var codeblock = m1;
                        var nextChar = m2;
        text = text.replace(/(?:\n\n|^)((?:(?:[ ]{4}|\t).*\n+)+)(\n*[ ]{0,3}[^ \t\n]|(?=~0))/g,
                function(wholeMatch,m1,m2) {
                        var codeblock = m1;
                        var nextChar = m2;

-               
+

                        codeblock = _EncodeCode( _Outdent(codeblock));
                        codeblock = _Detab(codeblock);
                        codeblock = codeblock.replace(/^\n+/g,""); // trim leading newlines
                        codeblock = _EncodeCode( _Outdent(codeblock));
                        codeblock = _Detab(codeblock);
                        codeblock = codeblock.replace(/^\n+/g,""); // trim leading newlines


@@ -895,26 +903,26 @@ var hashBlock = function(text) {
 var _DoCodeSpans = function(text) {
 //
 //   *  Backtick quotes are used for <code></code> spans.
 var _DoCodeSpans = function(text) {
 //
 //   *  Backtick quotes are used for <code></code> spans.

-// 
+//

 //   *  You can use multiple backticks as the delimiters if you want to
 //      include literal backticks in the code span. So, this input:
 //   *  You can use multiple backticks as the delimiters if you want to
 //      include literal backticks in the code span. So, this input:

-//      
+//

 //              Just type ``foo `bar` baz`` at the prompt.
 //              Just type ``foo `bar` baz`` at the prompt.

-//      
+//

 //        Will translate to:
 //        Will translate to:

-//      
+//

 //              <p>Just type <code>foo `bar` baz</code> at the prompt.</p>
 //              <p>Just type <code>foo `bar` baz</code> at the prompt.</p>

-//      
+//

 //     There's no arbitrary limit to the number of backticks you
 //     can use as delimters. If you need three consecutive backticks
 //     in your code, use four for delimiters, etc.
 //
 //  *  You can use spaces to get literal backticks at the edges:
 //     There's no arbitrary limit to the number of backticks you
 //     can use as delimters. If you need three consecutive backticks
 //     in your code, use four for delimiters, etc.
 //
 //  *  You can use spaces to get literal backticks at the edges:

-//      
+//

 //              ... type `` `bar` `` ...
 //              ... type `` `bar` `` ...

-//      
+//

 //        Turns to:
 //        Turns to:

-//      
+//

 //              ... type <code>`bar`</code> ...
 //
 
 //              ... type <code>`bar`</code> ...
 //
 


@@ -1017,7 +1025,7 @@ var _DoBlockQuotes = function(text) {
 
                        bq = bq.replace(/^[ \t]+$/gm,"");               // trim whitespace-only lines
                        bq = _RunBlockGamut(bq);                                // recurse
 
                        bq = bq.replace(/^[ \t]+$/gm,"");               // trim whitespace-only lines
                        bq = _RunBlockGamut(bq);                                // recurse

-                       
+

                        bq = bq.replace(/(^|\n)/g,"$1  ");
                        // These leading spaces screw with <pre> content, so we need to fix that:
                        bq = bq.replace(
                        bq = bq.replace(/(^|\n)/g,"$1  ");
                        // These leading spaces screw with <pre> content, so we need to fix that:
                        bq = bq.replace(


@@ -1029,7 +1037,7 @@ var _DoBlockQuotes = function(text) {
                                        pre = pre.replace(/~0/g,"");
                                        return pre;
                                });
                                        pre = pre.replace(/~0/g,"");
                                        return pre;
                                });

-                       
+

                        return hashBlock("<blockquote>\n" + bq + "\n</blockquote>");
                });
        return text;
                        return hashBlock("<blockquote>\n" + bq + "\n</blockquote>");
                });
        return text;


@@ -1088,14 +1096,14 @@ var _FormParagraphs = function(text) {
 
 var _EncodeAmpsAndAngles = function(text) {
 // Smart processing for ampersands and angle brackets that need to be encoded.
 
 var _EncodeAmpsAndAngles = function(text) {
 // Smart processing for ampersands and angle brackets that need to be encoded.

-       
+

        // Ampersand-encoding based entirely on Nat Irons's Amputator MT plugin:
        //   http://bumppo.net/projects/amputator/
        text = text.replace(/&(?!#?[xX]?(?:[0-9a-fA-F]+|\w+);)/g,"&amp;");
        // Ampersand-encoding based entirely on Nat Irons's Amputator MT plugin:
        //   http://bumppo.net/projects/amputator/
        text = text.replace(/&(?!#?[xX]?(?:[0-9a-fA-F]+|\w+);)/g,"&amp;");

-       
+

        // Encode naked <'s
        text = text.replace(/<(?![a-z\/?\$!])/gi,"&lt;");
        // Encode naked <'s
        text = text.replace(/<(?![a-z\/?\$!])/gi,"&lt;");

-       
+

        return text;
 }
 
        return text;
 }