fix: decode uri and sanitize whitespace

braintree · May 8, 2024 · cf7dbb8 · cf7dbb8
1 parent 1c0be2b
commit cf7dbb8
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 6 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # CHANGELOG
 
 ## 7.0.1
+
 - Improve sanitization of HTML entities
 
 ## 7.0.0

diff --git a/src/__tests__/index.test.ts b/src/__tests__/index.test.ts
@@ -132,7 +132,12 @@ describe("sanitizeUrl", () => {
       "javascri\npt:alert('xss')",
       "javascri\rpt:alert('xss')",
       "javascri\tpt:alert('xss')",
-      "javascrip\x74t:alert('XSS')",
+      "javascrip\\%74t:alert('XSS')",
+      "javascrip%5c%72t:alert()",
+      "javascrip%5Ctt:alert()",
+      "javascrip%255Ctt:alert()",
+      "javascrip%25%35Ctt:alert()",
+      "javascrip%25%35%43tt:alert()",
     ];
 
     attackVectors.forEach((vector) => {

diff --git a/src/constants.ts b/src/constants.ts
@@ -4,6 +4,7 @@ export const htmlCtrlEntityRegex = /&(newline|tab);/gi;
 export const ctrlCharactersRegex =
   /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim;
 export const urlSchemeRegex = /^.+(:|&colon;)/gim;
-export const whitespaceEscapeChars = /\\[nrt]/g;
+export const whitespaceEscapeCharsRegex =
+  /(\\|%5[cC])((%(6[eE]|72|74))|[nrt])/g;
 export const relativeFirstCharacters = [".", "/"];
 export const BLANK_URL = "about:blank";
diff --git a/src/index.ts b/src/index.ts
@@ -1,12 +1,13 @@
 import {
   BLANK_URL,
   ctrlCharactersRegex,
+  hexCodesRegex,
   htmlCtrlEntityRegex,
   htmlEntitiesRegex,
   invalidProtocolRegex,
   relativeFirstCharacters,
   urlSchemeRegex,
-  whitespaceEscapeChars,
+  whitespaceEscapeCharsRegex,
 } from "./constants";
 
 function isRelativeUrlWithoutProtocol(url: string): boolean {
@@ -26,18 +27,19 @@ export function sanitizeUrl(url?: string): string {
     return BLANK_URL;
   }
   let charsToDecode;
-  let decodedUrl = url;
+  let decodedUrl = decodeURIComponent(url);
+
   do {
     decodedUrl = decodeHtmlCharacters(decodedUrl)
       .replace(htmlCtrlEntityRegex, "")
       .replace(ctrlCharactersRegex, "")
-      .replace(whitespaceEscapeChars, "")
+      .replace(whitespaceEscapeCharsRegex, "")
       .trim();
     charsToDecode =
       decodedUrl.match(ctrlCharactersRegex) ||
       decodedUrl.match(htmlEntitiesRegex) ||
       decodedUrl.match(htmlCtrlEntityRegex) ||
-      decodedUrl.match(whitespaceEscapeChars);
+      decodedUrl.match(whitespaceEscapeCharsRegex);
   } while (charsToDecode && charsToDecode.length > 0);
   const sanitizedUrl = decodedUrl;
   if (!sanitizedUrl) {