From f54274442cea935a28ac1c6a8fc318addd8424b4 Mon Sep 17 00:00:00 2001 From: tzhangchi Date: Wed, 17 Aug 2022 10:03:00 +0800 Subject: [PATCH 1/6] feat(weakSql): deal with Incomplete string escaping or encoding --- .../src/blocks/group/utils/weak-sql/weakSqlCreator.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libs/components/editor-blocks/src/blocks/group/utils/weak-sql/weakSqlCreator.ts b/libs/components/editor-blocks/src/blocks/group/utils/weak-sql/weakSqlCreator.ts index 47debf2175..6d980155fa 100644 --- a/libs/components/editor-blocks/src/blocks/group/utils/weak-sql/weakSqlCreator.ts +++ b/libs/components/editor-blocks/src/blocks/group/utils/weak-sql/weakSqlCreator.ts @@ -49,7 +49,7 @@ const weakSqlCreator = (weak_sql_express = ''): Promise => { constraints.push({ field: field.trim(), relation: relation.trim() as Relation, - value: pickValue(value.replace(/&&|&|;/, '').trim()), + value: pickValue(value.replace(/&&|&|;/g, '').trim()), }); /* meaningless return value */ From 88645938822bba231323df2dac2ab170ce50e81e Mon Sep 17 00:00:00 2001 From: tzhangchi Date: Wed, 17 Aug 2022 10:14:34 +0800 Subject: [PATCH 2/6] fix(youtube): Incomplete URL substring sanitization --- .../src/components/source-view/format-url/youtube.ts | 3 ++- ！ | 0 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 ！ diff --git a/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts b/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts index ebc0c70be0..202f0dc968 100644 --- a/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts +++ b/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts @@ -1,5 +1,6 @@ export const isYoutubeUrl = (url?: string): boolean => { - return url.includes('youtu.be') || url.includes('youtube.com'); + const allowedHosts = ['youtu.be', 'youtube.com']; + return allowedHosts.includes(url); }; const _regexp = /.*(?:youtu.be\/|v\/|u\/\w\/|embed\/|watch\?v=)([^#&?]*).*/; diff --git a/！ b/！ new file mode 100644 index 0000000000..e69de29bb2 From a17ec1c5f9a6f2c5cf3e967c22a77c878b74bb19 Mon Sep 17 00:00:00 2001 From: tzhangchi Date: Wed, 17 Aug 2022 10:18:02 +0800 Subject: [PATCH 3/6] fix(youtube): Incomplete URL substring sanitization --- libs/components/editor-blocks/src/blocks/youtube/index.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libs/components/editor-blocks/src/blocks/youtube/index.ts b/libs/components/editor-blocks/src/blocks/youtube/index.ts index 363e7d78a9..26e4117961 100644 --- a/libs/components/editor-blocks/src/blocks/youtube/index.ts +++ b/libs/components/editor-blocks/src/blocks/youtube/index.ts @@ -19,7 +19,9 @@ export class YoutubeBlock extends BaseView { const tag_name = el.tagName; if (tag_name === 'A' && el.parentElement?.childElementCount === 1) { const href = el.getAttribute('href'); - if (href.indexOf('.youtube.com') !== -1) { + const allowedHosts = ['.youtube.com']; + + if (allowedHosts.includes(href)) { return [ { type: this.type, From fd9ed2862f1da7a145ec0d729001a8b1b4c549d8 Mon Sep 17 00:00:00 2001 From: tzhangchi Date: Wed, 17 Aug 2022 10:35:12 +0800 Subject: [PATCH 4/6] fix(youtube): Incomplete URL substring sanitization --- libs/components/editor-blocks/src/blocks/youtube/index.ts | 7 ++++--- .../src/components/source-view/format-url/youtube.ts | 5 +++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/libs/components/editor-blocks/src/blocks/youtube/index.ts b/libs/components/editor-blocks/src/blocks/youtube/index.ts index 26e4117961..42f22bcda4 100644 --- a/libs/components/editor-blocks/src/blocks/youtube/index.ts +++ b/libs/components/editor-blocks/src/blocks/youtube/index.ts @@ -1,9 +1,9 @@ +import { Protocol } from '@toeverything/datasource/db-service'; import { AsyncBlock, BaseView, SelectBlock, } from '@toeverything/framework/virgo'; -import { Protocol } from '@toeverything/datasource/db-service'; import { YoutubeView } from './YoutubeView'; export class YoutubeBlock extends BaseView { @@ -19,9 +19,10 @@ export class YoutubeBlock extends BaseView { const tag_name = el.tagName; if (tag_name === 'A' && el.parentElement?.childElementCount === 1) { const href = el.getAttribute('href'); - const allowedHosts = ['.youtube.com']; + const allowedHosts = ['www.youtu.be', 'www.youtube.com']; + const host = new URL(href).host; - if (allowedHosts.includes(href)) { + if (allowedHosts.includes(host)) { return [ { type: this.type, diff --git a/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts b/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts index 202f0dc968..56f165a515 100644 --- a/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts +++ b/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts @@ -1,6 +1,7 @@ export const isYoutubeUrl = (url?: string): boolean => { - const allowedHosts = ['youtu.be', 'youtube.com']; - return allowedHosts.includes(url); + const allowedHosts = ['www.youtu.be', 'www.youtube.com']; + const host = new URL(url).host; + return allowedHosts.includes(host); }; const _regexp = /.*(?:youtu.be\/|v\/|u\/\w\/|embed\/|watch\?v=)([^#&?]*).*/; From 2f17534394b3c69700fb60e467cf54e6231e5c5e Mon Sep 17 00:00:00 2001 From: tzhangchi Date: Wed, 17 Aug 2022 10:37:04 +0800 Subject: [PATCH 5/6] fix(figma): Incomplete URL substring sanitization --- libs/components/editor-blocks/src/blocks/figma/index.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libs/components/editor-blocks/src/blocks/figma/index.ts b/libs/components/editor-blocks/src/blocks/figma/index.ts index b3e0b76b8d..3ed44c9c85 100644 --- a/libs/components/editor-blocks/src/blocks/figma/index.ts +++ b/libs/components/editor-blocks/src/blocks/figma/index.ts @@ -1,9 +1,9 @@ +import { Protocol } from '@toeverything/datasource/db-service'; import { AsyncBlock, BaseView, SelectBlock, } from '@toeverything/framework/virgo'; -import { Protocol, services } from '@toeverything/datasource/db-service'; import { FigmaView } from './FigmaView'; export class FigmaBlock extends BaseView { @@ -19,7 +19,10 @@ export class FigmaBlock extends BaseView { const tag_name = el.tagName; if (tag_name === 'A' && el.parentElement?.childElementCount === 1) { const href = el.getAttribute('href'); - if (href.indexOf('.figma.com') !== -1) { + const allowedHosts = ['www.figma.com']; + const host = new URL(href).host; + + if (allowedHosts.includes(host)) { return [ { type: this.type, From 137f48c33879f6237f761fd8514d8556ef2755b4 Mon Sep 17 00:00:00 2001 From: Whitewater Date: Wed, 17 Aug 2022 11:01:41 +0800 Subject: [PATCH 6/6] chore: remove unused file --- ！ | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 ！ diff --git a/！ b/！ deleted file mode 100644 index e69de29bb2..0000000000