Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix to improve sanitizing href inputs for SVG and HTML text elements #5803

Merged
merged 15 commits into from
Jul 6, 2021
Merged

Fix to improve sanitizing href inputs for SVG and HTML text elements #5803

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
d84e9c3
dummyAnchor href check
archmoj Jul 6, 2021
96376e8
set 2020 in license src so that syntax text do not complain
archmoj Jul 6, 2021
c8014f8
update changelog for v1.58.5
archmoj Jul 6, 2021
23fb7fa
1.58.5
archmoj Jul 6, 2021
3a754db
Revert "1.58.5"
archmoj Jul 6, 2021
44455eb
Revert "set 2020 in license src so that syntax text do not complain"
archmoj Jul 6, 2021
ddef8c7
Revert "update changelog for v1.58.5"
archmoj Jul 6, 2021
668c371
Merge branch 'version-2.2.0' into dummy-anchor-href
archmoj Jul 6, 2021
2e21b81
place v1.58.5 in changelog
archmoj Jul 6, 2021
adaea4c
update changelog for v2.2.1
archmoj Jul 6, 2021
b4ea784
install exact plotly/d3 to reduce the chance of impacting by breaking…
archmoj Jul 6, 2021
5abb740
2.2.1
archmoj Jul 6, 2021
109f394
Merge remote-tracking branch 'origin/master' into dummy-anchor-href
archmoj Jul 6, 2021
1f1e7ae
adjust mapbox_angles compare test
archmoj Jul 6, 2021
75f6351
update versions in README
archmoj Jul 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,18 @@ To see all merged commits on the master branch that will be part of the next plo

where X.Y.Z is the semver of most recent plotly.js release.

## [2.2.1] -- 2021-07-06

### Fixed
- Fix to improve sanitizing href inputs for SVG and HTML text elements [[#5803](https://github.com/plotly/plotly.js/pull/5803)]


## [1.58.5] -- 2021-07-06

### Fixed
- Fix to improve sanitizing href inputs for SVG and HTML text elements [[#5803](https://github.com/plotly/plotly.js/pull/5803)]


## [2.2.0] -- 2021-06-28

### Added
Expand Down
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ You may also consider using [`plotly.js-dist`](https://www.npmjs.com/package/plo

```html
<head>
<script src="https://cdn.plot.ly/plotly-2.2.0.min.js"></script>
<script src="https://cdn.plot.ly/plotly-2.2.1.min.js"></script>
</head>
<body>
<div id="gd"></div>
Expand All @@ -72,7 +72,7 @@ You may also consider using [`plotly.js-dist`](https://www.npmjs.com/package/plo
Alternatively you may consider using [native ES6 import](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules) in the script tag.
```html
<script type="module">
import "https://cdn.plot.ly/plotly-2.2.0.min.js"
import "https://cdn.plot.ly/plotly-2.2.1.min.js"
Plotly.newPlot("gd", [{ y: [1, 2, 3] }])
</script>
```
Expand All @@ -82,10 +82,10 @@ Fastly supports Plotly.js with free CDN service. Read more at <https://www.fastl
### Un-minified versions are also available on CDN
While non-minified source files may contain characters outside UTF-8, it is recommended that you specify the `charset` when loading those bundles.
```html
<script src="https://cdn.plot.ly/plotly-2.2.0.js" charset="utf-8"></script>
<script src="https://cdn.plot.ly/plotly-2.2.1.js" charset="utf-8"></script>
```

> Please note that as of v2 the "plotly-latest" outputs (e.g. https://cdn.plot.ly/plotly-latest.min.js) will no longer be updated on the CDN, and will stay at the last v1 patch v1.58.4. Therefore, to use the CDN with plotly.js v2 and higher, you must specify an exact plotly.js version.
> Please note that as of v2 the "plotly-latest" outputs (e.g. https://cdn.plot.ly/plotly-latest.min.js) will no longer be updated on the CDN, and will stay at the last v1 patch v1.58.5. Therefore, to use the CDN with plotly.js v2 and higher, you must specify an exact plotly.js version.

To support MathJax, you need to load version two of MathJax e.g. `v2.7.5` files from CDN or npm.
```html
Expand Down
46 changes: 23 additions & 23 deletions dist/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,9 @@ The main plotly.js bundles weight in at:
| 8 MB | 3.4 MB | 1019.6 kB | 8.3 MB |

#### CDN links
> https://cdn.plot.ly/plotly-2.2.0.js
> https://cdn.plot.ly/plotly-2.2.1.js

> https://cdn.plot.ly/plotly-2.2.0.min.js
> https://cdn.plot.ly/plotly-2.2.1.min.js


#### npm packages
Expand Down Expand Up @@ -94,9 +94,9 @@ The `basic` partial bundle contains trace modules `bar`, `pie` and `scatter`.
| 2.7 MB | 1007.3 kB | 327.3 kB |

#### CDN links
> https://cdn.plot.ly/plotly-basic-2.2.0.js
> https://cdn.plot.ly/plotly-basic-2.2.1.js

> https://cdn.plot.ly/plotly-basic-2.2.0.min.js
> https://cdn.plot.ly/plotly-basic-2.2.1.min.js


#### npm packages
Expand All @@ -114,12 +114,12 @@ The `cartesian` partial bundle contains trace modules `bar`, `box`, `contour`, `

| Raw size | Minified size | Minified + gzip size |
|------|-----------------|------------------------|
| 3.3 MB | 1.2 MB | 398.7 kB |
| 3.3 MB | 1.2 MB | 398.8 kB |

#### CDN links
> https://cdn.plot.ly/plotly-cartesian-2.2.0.js
> https://cdn.plot.ly/plotly-cartesian-2.2.1.js

> https://cdn.plot.ly/plotly-cartesian-2.2.0.min.js
> https://cdn.plot.ly/plotly-cartesian-2.2.1.min.js


#### npm packages
Expand All @@ -137,12 +137,12 @@ The `geo` partial bundle contains trace modules `choropleth`, `scatter` and `sca

| Raw size | Minified size | Minified + gzip size |
|------|-----------------|------------------------|
| 2.9 MB | 1 MB | 337.3 kB |
| 2.9 MB | 1 MB | 337.4 kB |

#### CDN links
> https://cdn.plot.ly/plotly-geo-2.2.0.js
> https://cdn.plot.ly/plotly-geo-2.2.1.js

> https://cdn.plot.ly/plotly-geo-2.2.0.min.js
> https://cdn.plot.ly/plotly-geo-2.2.1.min.js


#### npm packages
Expand All @@ -163,9 +163,9 @@ The `gl3d` partial bundle contains trace modules `cone`, `isosurface`, `mesh3d`,
| 3.8 MB | 1.5 MB | 482.7 kB |

#### CDN links
> https://cdn.plot.ly/plotly-gl3d-2.2.0.js
> https://cdn.plot.ly/plotly-gl3d-2.2.1.js

> https://cdn.plot.ly/plotly-gl3d-2.2.0.min.js
> https://cdn.plot.ly/plotly-gl3d-2.2.1.min.js


#### npm packages
Expand All @@ -183,12 +183,12 @@ The `gl2d` partial bundle contains trace modules `heatmapgl`, `parcoords`, `poin

| Raw size | Minified size | Minified + gzip size |
|------|-----------------|------------------------|
| 3.8 MB | 1.5 MB | 503.1 kB |
| 3.8 MB | 1.5 MB | 503.2 kB |

#### CDN links
> https://cdn.plot.ly/plotly-gl2d-2.2.0.js
> https://cdn.plot.ly/plotly-gl2d-2.2.1.js

> https://cdn.plot.ly/plotly-gl2d-2.2.0.min.js
> https://cdn.plot.ly/plotly-gl2d-2.2.1.min.js


#### npm packages
Expand All @@ -209,9 +209,9 @@ The `mapbox` partial bundle contains trace modules `choroplethmapbox`, `densitym
| 4.4 MB | 1.8 MB | 525 kB |

#### CDN links
> https://cdn.plot.ly/plotly-mapbox-2.2.0.js
> https://cdn.plot.ly/plotly-mapbox-2.2.1.js

> https://cdn.plot.ly/plotly-mapbox-2.2.0.min.js
> https://cdn.plot.ly/plotly-mapbox-2.2.1.min.js


#### npm packages
Expand All @@ -229,12 +229,12 @@ The `finance` partial bundle contains trace modules `bar`, `candlestick`, `funne

| Raw size | Minified size | Minified + gzip size |
|------|-----------------|------------------------|
| 3 MB | 1.1 MB | 353.5 kB |
| 3 MB | 1.1 MB | 353.6 kB |

#### CDN links
> https://cdn.plot.ly/plotly-finance-2.2.0.js
> https://cdn.plot.ly/plotly-finance-2.2.1.js

> https://cdn.plot.ly/plotly-finance-2.2.0.min.js
> https://cdn.plot.ly/plotly-finance-2.2.1.min.js


#### npm packages
Expand All @@ -252,12 +252,12 @@ The `strict` partial bundle contains trace modules `bar`, `barpolar`, `box`, `ca

| Raw size | Minified size | Minified + gzip size |
|------|-----------------|------------------------|
| 6.7 MB | 2.8 MB | 840.4 kB |
| 6.7 MB | 2.8 MB | 840.5 kB |

#### CDN links
> https://cdn.plot.ly/plotly-strict-2.2.0.js
> https://cdn.plot.ly/plotly-strict-2.2.1.js

> https://cdn.plot.ly/plotly-strict-2.2.0.min.js
> https://cdn.plot.ly/plotly-strict-2.2.1.min.js


#### npm packages
Expand Down
43 changes: 29 additions & 14 deletions dist/plotly-basic.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/**
* plotly.js (basic) v2.2.0
* plotly.js (basic) v2.2.1
* Copyright 2012-2021, Plotly, Inc.
* All rights reserved.
* Licensed under the MIT license
Expand Down Expand Up @@ -49233,14 +49233,9 @@ function buildSVGText(containerNode, str) {
var href = getQuotedMatch(extra, HREFMATCH);

if(href) {
// check safe protocols
var dummyAnchor = document.createElement('a');
dummyAnchor.href = href;
if(PROTOCOLS.indexOf(dummyAnchor.protocol) !== -1) {
// Decode href to allow both already encoded and not encoded
// URIs. Without decoding prior encoding, an already encoded
// URI would be encoded twice producing a semantically different URI.
nodeSpec.href = encodeURI(decodeURI(href));
var safeHref = sanitizeHref(href);
if(safeHref) {
nodeSpec.href = safeHref;
nodeSpec.target = getQuotedMatch(extra, TARGETMATCH) || '_blank';
nodeSpec.popup = getQuotedMatch(extra, POPUPMATCH);
}
Expand All @@ -49255,6 +49250,27 @@ function buildSVGText(containerNode, str) {
return hasLink;
}

function sanitizeHref(href) {
var decodedHref = encodeURI(decodeURI(href));
var dummyAnchor1 = document.createElement('a');
var dummyAnchor2 = document.createElement('a');
dummyAnchor1.href = href;
dummyAnchor2.href = decodedHref;

var p1 = dummyAnchor1.protocol;
var p2 = dummyAnchor2.protocol;

// check safe protocols
if(
PROTOCOLS.indexOf(p1) !== -1 &&
PROTOCOLS.indexOf(p2) !== -1
) {
return decodedHref;
} else {
return '';
}
}

/*
* sanitizeHTML: port of buildSVGText aimed at providing a clean subset of HTML
* @param {string} str: the html string to clean
Expand Down Expand Up @@ -49289,10 +49305,9 @@ exports.sanitizeHTML = function sanitizeHTML(str) {
var href = getQuotedMatch(extra, HREFMATCH);

if(href) {
var dummyAnchor = document.createElement('a');
dummyAnchor.href = href;
if(PROTOCOLS.indexOf(dummyAnchor.protocol) !== -1) {
nodeAttrs.href = encodeURI(decodeURI(href));
var safeHref = sanitizeHref(href);
if(safeHref) {
nodeAttrs.href = safeHref;
var target = getQuotedMatch(extra, TARGETMATCH);
if(target) {
nodeAttrs.target = target;
Expand Down Expand Up @@ -84237,7 +84252,7 @@ function getSortFunc(opts, d2c) {
'use strict';

// package version injected by `npm run preprocess`
exports.version = '2.2.0';
exports.version = '2.2.1';

},{}]},{},[8])(8)
});
4 changes: 2 additions & 2 deletions dist/plotly-basic.min.js
View file
Open in desktop

Large diffs are not rendered by default.

43 changes: 29 additions & 14 deletions dist/plotly-cartesian.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/**
* plotly.js (cartesian) v2.2.0
* plotly.js (cartesian) v2.2.1
* Copyright 2012-2021, Plotly, Inc.
* All rights reserved.
* Licensed under the MIT license
Expand Down Expand Up @@ -58392,14 +58392,9 @@ function buildSVGText(containerNode, str) {
var href = getQuotedMatch(extra, HREFMATCH);

if(href) {
// check safe protocols
var dummyAnchor = document.createElement('a');
dummyAnchor.href = href;
if(PROTOCOLS.indexOf(dummyAnchor.protocol) !== -1) {
// Decode href to allow both already encoded and not encoded
// URIs. Without decoding prior encoding, an already encoded
// URI would be encoded twice producing a semantically different URI.
nodeSpec.href = encodeURI(decodeURI(href));
var safeHref = sanitizeHref(href);
if(safeHref) {
nodeSpec.href = safeHref;
nodeSpec.target = getQuotedMatch(extra, TARGETMATCH) || '_blank';
nodeSpec.popup = getQuotedMatch(extra, POPUPMATCH);
}
Expand All @@ -58414,6 +58409,27 @@ function buildSVGText(containerNode, str) {
return hasLink;
}

function sanitizeHref(href) {
var decodedHref = encodeURI(decodeURI(href));
var dummyAnchor1 = document.createElement('a');
var dummyAnchor2 = document.createElement('a');
dummyAnchor1.href = href;
dummyAnchor2.href = decodedHref;

var p1 = dummyAnchor1.protocol;
var p2 = dummyAnchor2.protocol;

// check safe protocols
if(
PROTOCOLS.indexOf(p1) !== -1 &&
PROTOCOLS.indexOf(p2) !== -1
) {
return decodedHref;
} else {
return '';
}
}

/*
* sanitizeHTML: port of buildSVGText aimed at providing a clean subset of HTML
* @param {string} str: the html string to clean
Expand Down Expand Up @@ -58448,10 +58464,9 @@ exports.sanitizeHTML = function sanitizeHTML(str) {
var href = getQuotedMatch(extra, HREFMATCH);

if(href) {
var dummyAnchor = document.createElement('a');
dummyAnchor.href = href;
if(PROTOCOLS.indexOf(dummyAnchor.protocol) !== -1) {
nodeAttrs.href = encodeURI(decodeURI(href));
var safeHref = sanitizeHref(href);
if(safeHref) {
nodeAttrs.href = safeHref;
var target = getQuotedMatch(extra, TARGETMATCH);
if(target) {
nodeAttrs.target = target;
Expand Down Expand Up @@ -104098,7 +104113,7 @@ function getSortFunc(opts, d2c) {
'use strict';

// package version injected by `npm run preprocess`
exports.version = '2.2.0';
exports.version = '2.2.1';

},{}]},{},[15])(15)
});
4 changes: 2 additions & 2 deletions dist/plotly-cartesian.min.js
View file
Open in desktop

Large diffs are not rendered by default.

Loading