Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-07-13 03:27:39 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Bugfix: resolve #243

Browse source 
And cleanup the HTML rules along the way
This commit is contained in:
the-djmaze 2022-02-25 11:11:28 +01:00
parent 93dcea6d35
commit a9edbe9ecf
1 changed files with 19 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

61
dev/Common/Html.js
View file

@ -67,44 +67,27 @@ export const
'background', 'bgcolor', 'alt', 'height', 'width', 'src', 'href', 'background', 'bgcolor', 'alt', 'height', 'width', 'src', 'href',
'border', 'bordercolor', 'charset', 'direction', 'language', 'border', 'bordercolor', 'charset', 'direction', 'language',
// a // a
'coords', 'download', 'hreflang', 'shape', 'download', 'hreflang',
// body // body
'alink', 'bgproperties', 'bottommargin', 'leftmargin', 'link', 'rightmargin', 'text', 'topmargin', 'vlink', 'alink', 'bottommargin', 'leftmargin', 'link', 'rightmargin', 'text', 'topmargin', 'vlink',
'marginwidth', 'marginheight', 'offset',
// button,
'disabled', 'type', 'value',
// col // col
'align', 'valign', 'align', 'valign',
// font // font
'color', 'face', 'size', 'color', 'face', 'size',
// form
'novalidate',
// hr // hr
'noshade', 'noshade',
// img // img
'hspace', 'sizes', 'srcset', 'vspace', 'usemap', 'hspace', 'sizes', 'srcset', 'vspace',
// input, textarea
'checked', 'max', 'min', 'maxlength', 'multiple', 'pattern', 'placeholder', 'readonly',
'required', 'step', 'wrap',
// label
'for',
// meter // meter
'low', 'high', 'optimum', 'low', 'high', 'optimum', 'value',
// ol // ol
'reversed', 'start', 'reversed', 'start',
// option
'selected', 'label',
// table // table
'cols', 'rows', 'frame', 'rules', 'summary', 'cellpadding', 'cellspacing', 'cols', 'rows', 'frame', 'rules', 'summary', 'cellpadding', 'cellspacing',
// th // th
'abbr', 'scope', 'abbr', 'scope',
// td // td
'axis', 'colspan', 'rowspan', 'headers', 'nowrap' 'colspan', 'rowspan', 'headers'
],
disallowedAttributes = [
'id', 'class', 'contenteditable', 'designmode', 'formaction', 'manifest', 'action',
'data-bind', 'data-reactid', 'xmlns', 'srcset',
'fscommand', 'seeksegmenttime'
], ],
disallowedTags = [ disallowedTags = [
'HEAD','STYLE','SVG','SCRIPT','TITLE','LINK','BASE','META', 'HEAD','STYLE','SVG','SCRIPT','TITLE','LINK','BASE','META',
@ -168,6 +151,19 @@ export const
return; return;
} }
*/ */
const aAttrsForRemove = [];
if (oElement.hasAttributes()) {
let i = oElement.attributes.length;
while (i--) {
let sAttrName = oElement.attributes[i].name.toLowerCase();
if (!allowedAttributes.includes(sAttrName)) {
delAttribute(sAttrName);
aAttrsForRemove.push(sAttrName);
}
}
}
if ('BODY' === name) { if ('BODY' === name) {
forEachObjectEntry(tasks, (name, cb) => { forEachObjectEntry(tasks, (name, cb) => {
if (hasAttribute(name)) { if (hasAttribute(name)) {
@ -189,7 +185,7 @@ export const
else if ('A' === name) { else if ('A' === name) {
value = oElement.href; value = oElement.href;
value = stripTracking(value); value = stripTracking(value);
if (!/^([a-z]+):/i.test(value) && '//' !== value.slice(0, 2)) { if (!/^([a-z]+):/i.test(value)) {
setAttribute('data-x-broken-href', value); setAttribute('data-x-broken-href', value);
delAttribute('href'); delAttribute('href');
} else { } else {
@ -199,25 +195,6 @@ export const
setAttribute('tabindex', '-1'); setAttribute('tabindex', '-1');
} }
const aAttrsForRemove = [];
if (oElement.hasAttributes()) {
let i = oElement.attributes.length;
while (i--) {
let sAttrName = oElement.attributes[i].name.toLowerCase();
if (!allowedAttributes.includes(sAttrName)
|| 'on' === sAttrName.slice(0, 2)
|| 'form' === sAttrName.slice(0, 4)
// || 'data-' === sAttrName.slice(0, 5)
// || sAttrName.includes(':')
|| disallowedAttributes.includes(sAttrName))
{
delAttribute(sAttrName);
aAttrsForRemove.push(sAttrName);
}
}
}
// SVG xlink:href // SVG xlink:href
/* /*
if (hasAttribute('xlink:href')) { if (hasAttribute('xlink:href')) {