Kharec/m2h
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(parser): normalize decoded URLs before scheme checks

Browse Source
This commit is contained in:
Sandro CURY CAZZANIGA
2026-02-19 17:50:35 +01:00
parent da24af38e3
commit 5b90ade52a
1 changed files with 26 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
lib/MarkdownParser.pm
View File

@@ -379,16 +379,14 @@ s/\x01F$i\x02/<$part->{tag}>@{[escape_html($part->{content})]}<\/$part->{tag}>/;
sub is_safe_url { sub is_safe_url {
my ($url) = @_; my ($url) = @_;
my $normalized = $url // ''; my $normalized = decode_url_escapes($url);
$normalized =~ s/^\s+//; $normalized =~ s/^\s+//;
$normalized =~ s/\s+$//; $normalized =~ s/\s+$//;
$normalized =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg my $scheme_check = $normalized;
while $normalized =~ /%[0-9A-Fa-f]{2}/; $scheme_check =~ s/[\x00-\x20\x7f]+//g;
$normalized =~ s/&#x([0-9A-Fa-f]+);?/chr(hex($1))/eg;
$normalized =~ s/&#(\d+);?/chr($1)/eg;
if ( $normalized =~ /^([a-z][a-z0-9+\-.]*):/i ) { if ( $scheme_check =~ /^([a-z][a-z0-9+\-.]*):/i ) {
my $scheme = lc $1; my $scheme = lc $1;
return 1 return 1
if $scheme eq 'http' || $scheme eq 'https' || $scheme eq 'mailto'; if $scheme eq 'http' || $scheme eq 'https' || $scheme eq 'mailto';
@@ -398,6 +396,28 @@ sub is_safe_url {
return 1; return 1;
} }
sub decode_url_escapes {
my ($value) = @_;
my $decoded = $value // '';
for ( 1 .. 8 ) {
my $before = $decoded;
$decoded =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
$decoded =~ s/&#x([0-9A-Fa-f]+);?/_safe_chr(hex($1))/eg;
$decoded =~ s/&#(\d+);?/_safe_chr($1)/eg;
last if $decoded eq $before;
}
return $decoded;
}
sub _safe_chr {
my ($codepoint) = @_;
return '' if !defined $codepoint;
return '' if $codepoint > 0x10FFFF;
return chr($codepoint);
}
sub escape_html { sub escape_html {
my ($text) = @_; my ($text) = @_;
$text =~ s/&/&amp;/g; $text =~ s/&/&amp;/g;