Merge branch 'shout-float-fix' into 'develop'

Fix HTML exploit of the day (shout-float in rich media)

See merge request pleroma/pleroma-fe!1689

1 files changed, 10 insertions, 2 deletions

diff --git a/src/services/html_converter/utility.service.js b/src/services/html_converter/utility.service.js
index 583ccca5..f1042971 100644
--- a/src/services/html_converter/utility.service.js
+++ b/src/services/html_converter/utility.service.js
@@ -16,7 +16,7 @@ export const getTagName = (tag) => {
  * @return {Object} - map of attributes key = attribute name, value = attribute value
  *   attributes without values represented as boolean true
  */
-export const getAttrs = tag => {
+export const getAttrs = (tag, filter) => {
   const innertag = tag
     .substring(1, tag.length - 1)
     .replace(new RegExp('^' + getTagName(tag)), '')
@@ -28,7 +28,15 @@ export const getAttrs = tag => {
       if (!v) return [k, true]
       return [k, v.substring(1, v.length - 1)]
     })
-  return Object.fromEntries(attrs)
+  const defaultFilter = ([k, v]) => {
+    const attrKey = k.toLowerCase()
+    if (attrKey === 'style') return false
+    if (attrKey === 'class') {
+      return v === 'greentext' || v === 'cyantext'
+    }
+    return true
+  }
+  return Object.fromEntries(attrs.filter(filter || defaultFilter))
 }
 
 /**