Update Vendors (#337)

* update & migrate gitea sdk (Fix Delete Tag Issue) * upgraded github.com/AlecAivazis/survey v2.2.7 => v2.2.8 * upgraded github.com/adrg/xdg v0.2.3 => v0.3.1 * upgraded github.com/araddon/dateparse * upgraded github.com/olekukonko/tablewriter v0.0.4 => v0.0.5 * upgraded gopkg.in/yaml.v2 v2.3.0 => v2.4.0 Reviewed-on: https://gitea.com/gitea/tea/pulls/337 Reviewed-by: Norwin <noerw@noreply.gitea.io> Reviewed-by: khmarbaise <khmarbaise@noreply.gitea.io> Co-authored-by: 6543 <6543@obermui.de> Co-committed-by: 6543 <6543@obermui.de>
2021-03-05 18:06:25 +08:00
parent 15c4edba1a
commit 0d98cbd657
430 changed files with 18242 additions and 5643 deletions
--- a/vendor/github.com/microcosm-cc/bluemonday/sanitize.go
+++ b/vendor/github.com/microcosm-cc/bluemonday/sanitize.go
@@ -34,19 +34,15 @@ import (
 	"io"
 	"net/url"
 	"regexp"
-	"strconv"
 	"strings"

 	"golang.org/x/net/html"
-
-	cssparser "github.com/chris-ramon/douceur/parser"
 )

 var (
 	dataAttribute             = regexp.MustCompile("^data-.+")
 	dataAttributeXMLPrefix    = regexp.MustCompile("^xml.+")
 	dataAttributeInvalidChars = regexp.MustCompile("[A-Z;]+")
-	cssUnicodeChar            = regexp.MustCompile(`\\[0-9a-f]{1,6} ?`)
 )

 // Sanitize takes a string that contains a HTML fragment or document and applies
@@ -86,98 +82,6 @@ func (p *Policy) SanitizeReader(r io.Reader) *bytes.Buffer {
 	return p.sanitize(r)
 }

-const escapedURLChars = "'<>\"\r"
-
-func escapeUrlComponent(val string) string {
-	w := bytes.NewBufferString("")
-	i := strings.IndexAny(val, escapedURLChars)
-	for i != -1 {
-		if _, err := w.WriteString(val[:i]); err != nil {
-			return w.String()
-		}
-		var esc string
-		switch val[i] {
-		case '\'':
-			// "&#39;" is shorter than "&apos;" and apos was not in HTML until HTML5.
-			esc = "&#39;"
-		case '<':
-			esc = "&lt;"
-		case '>':
-			esc = "&gt;"
-		case '"':
-			// "&#34;" is shorter than "&quot;".
-			esc = "&#34;"
-		case '\r':
-			esc = "&#13;"
-		default:
-			panic("unrecognized escape character")
-		}
-		val = val[i+1:]
-		if _, err := w.WriteString(esc); err != nil {
-			return w.String()
-		}
-		i = strings.IndexAny(val, escapedURLChars)
-	}
-	w.WriteString(val)
-	return w.String()
-}
-
-func sanitizedUrl(val string) (string, error) {
-	u, err := url.Parse(val)
-	if err != nil {
-		return "", err
-	}
-	// sanitize the url query params
-	sanitizedQueryValues := make(url.Values, 0)
-	queryValues := u.Query()
-	for k, vals := range queryValues {
-		sk := html.EscapeString(k)
-		for _, v := range vals {
-			sv := v
-			sanitizedQueryValues.Add(sk, sv)
-		}
-	}
-	u.RawQuery = sanitizedQueryValues.Encode()
-	// u.String() will also sanitize host/scheme/user/pass
-	return u.String(), nil
-}
-
-func (p *Policy) writeLinkableBuf(buff *bytes.Buffer, token *html.Token) {
-	// do not escape multiple query parameters
-	tokenBuff := bytes.NewBufferString("")
-	tokenBuff.WriteString("<")
-	tokenBuff.WriteString(token.Data)
-	for _, attr := range token.Attr {
-		tokenBuff.WriteByte(' ')
-		tokenBuff.WriteString(attr.Key)
-		tokenBuff.WriteString(`="`)
-		switch attr.Key {
-		case "href", "src":
-			u, ok := p.validURL(attr.Val)
-			if !ok {
-				tokenBuff.WriteString(html.EscapeString(attr.Val))
-				continue
-			}
-			u, err := sanitizedUrl(u)
-			if err == nil {
-				tokenBuff.WriteString(u)
-			} else {
-				// fallthrough
-				tokenBuff.WriteString(html.EscapeString(attr.Val))
-			}
-		default:
-			// re-apply
-			tokenBuff.WriteString(html.EscapeString(attr.Val))
-		}
-		tokenBuff.WriteByte('"')
-	}
-	if token.Type == html.SelfClosingTagToken {
-		tokenBuff.WriteString("/")
-	}
-	tokenBuff.WriteString(">")
-	buff.WriteString(tokenBuff.String())
-}
-
 // Performs the actual sanitization process.
 func (p *Policy) sanitize(r io.Reader) *bytes.Buffer {

@@ -229,23 +133,20 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer {

 		case html.StartTagToken:

-			mostRecentlyStartedToken = strings.ToLower(token.Data)
+			mostRecentlyStartedToken = token.Data

 			aps, ok := p.elsAndAttrs[token.Data]
 			if !ok {
-				aa, matched := p.matchRegex(token.Data)
-				if !matched {
-					if _, ok := p.setOfElementsToSkipContent[token.Data]; ok {
-						skipElementContent = true
-						skippingElementsCount++
-					}
-					if p.addSpaces {
-						buff.WriteString(" ")
-					}
-					break
+				if _, ok := p.setOfElementsToSkipContent[token.Data]; ok {
+					skipElementContent = true
+					skippingElementsCount++
 				}
-				aps = aa
+				if p.addSpaces {
+					buff.WriteString(" ")
+				}
+				break
 			}
+
 			if len(token.Attr) != 0 {
 				token.Attr = p.sanitizeAttrs(token.Data, token.Attr, aps)
 			}
@@ -262,17 +163,12 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer {
 			}

 			if !skipElementContent {
-				// do not escape multiple query parameters
-				if linkable(token.Data) {
-					p.writeLinkableBuf(&buff, &token)
-				} else {
-					buff.WriteString(token.String())
-				}
+				buff.WriteString(token.String())
 			}

 		case html.EndTagToken:

-			if mostRecentlyStartedToken == strings.ToLower(token.Data) {
+			if mostRecentlyStartedToken == token.Data {
 				mostRecentlyStartedToken = ""
 			}

@@ -286,27 +182,18 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer {
 				}
 				break
 			}
+
 			if _, ok := p.elsAndAttrs[token.Data]; !ok {
-				match := false
-				for regex := range p.elsMatchingAndAttrs {
-					if regex.MatchString(token.Data) {
-						skipElementContent = false
-						match = true
-						break
-					}
-				}
-				if _, ok := p.setOfElementsToSkipContent[token.Data]; ok && !match {
+				if _, ok := p.setOfElementsToSkipContent[token.Data]; ok {
 					skippingElementsCount--
 					if skippingElementsCount == 0 {
 						skipElementContent = false
 					}
 				}
-				if !match {
-					if p.addSpaces {
-						buff.WriteString(" ")
-					}
-					break
+				if p.addSpaces {
+					buff.WriteString(" ")
 				}
+				break
 			}

 			if !skipElementContent {
@@ -317,14 +204,10 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer {

 			aps, ok := p.elsAndAttrs[token.Data]
 			if !ok {
-				aa, matched := p.matchRegex(token.Data)
-				if !matched {
-					if p.addSpaces && !matched {
-						buff.WriteString(" ")
-					}
-					break
+				if p.addSpaces {
+					buff.WriteString(" ")
 				}
-				aps = aa
+				break
 			}

 			if len(token.Attr) != 0 {
@@ -334,16 +217,12 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer {
 			if len(token.Attr) == 0 && !p.allowNoAttrs(token.Data) {
 				if p.addSpaces {
 					buff.WriteString(" ")
-					break
 				}
+				break
 			}
+
 			if !skipElementContent {
-				// do not escape multiple query parameters
-				if linkable(token.Data) {
-					p.writeLinkableBuf(&buff, &token)
-				} else {
-					buff.WriteString(token.String())
-				}
+				buff.WriteString(token.String())
 			}

 		case html.TextToken:
@@ -363,7 +242,6 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer {
 					buff.WriteString(token.String())
 				}
 			}
-
 		default:
 			// A token that didn't exist in the html package when we wrote this
 			return &bytes.Buffer{}
@@ -384,23 +262,6 @@ func (p *Policy) sanitizeAttrs(
 		return attrs
 	}

-	hasStylePolicies := false
-	sps, elementHasStylePolicies := p.elsAndStyles[elementName]
-	if len(p.globalStyles) > 0 || (elementHasStylePolicies && len(sps) > 0) {
-		hasStylePolicies = true
-	}
-	// no specific element policy found, look for a pattern match
-	if !hasStylePolicies {
-		for k, v := range p.elsMatchingAndStyles {
-			if k.MatchString(elementName) {
-				if len(v) > 0 {
-					hasStylePolicies = true
-					break
-				}
-			}
-		}
-	}
-
 	// Builds a new attribute slice based on the whether the attribute has been
 	// whitelisted explicitly or globally.
 	cleanAttrs := []html.Attribute{}
@@ -412,19 +273,6 @@ func (p *Policy) sanitizeAttrs(
 				continue
 			}
 		}
-		// Is this a "style" attribute, and if so, do we need to sanitize it?
-		if htmlAttr.Key == "style" && hasStylePolicies {
-			htmlAttr = p.sanitizeStyles(htmlAttr, elementName)
-			if htmlAttr.Val == "" {
-				// We've sanitized away any and all styles; don't bother to
-				// output the style attribute (even if it's allowed)
-				continue
-			} else {
-				cleanAttrs = append(cleanAttrs, htmlAttr)
-				continue
-			}
-		}
-
 		// Is there an element specific attribute policy that applies?
 		if ap, ok := aps[htmlAttr.Key]; ok {
 			if ap.regexp != nil {
@@ -506,8 +354,6 @@ func (p *Policy) sanitizeAttrs(

 		if (p.requireNoFollow ||
 			p.requireNoFollowFullyQualifiedLinks ||
-			p.requireNoReferrer ||
-			p.requireNoReferrerFullyQualifiedLinks ||
 			p.addTargetBlankToFullyQualifiedLinks) &&
 			len(cleanAttrs) > 0 {

@@ -535,16 +381,12 @@ func (p *Policy) sanitizeAttrs(
 				if hrefFound {
 					var (
 						noFollowFound    bool
-						noReferrerFound  bool
 						targetBlankFound bool
 					)

 					addNoFollow := (p.requireNoFollow ||
 						externalLink && p.requireNoFollowFullyQualifiedLinks)

-					addNoReferrer := (p.requireNoReferrer ||
-						externalLink && p.requireNoReferrerFullyQualifiedLinks)
-
 					addTargetBlank := (externalLink &&
 						p.addTargetBlankToFullyQualifiedLinks)

@@ -552,18 +394,18 @@ func (p *Policy) sanitizeAttrs(
 					for _, htmlAttr := range cleanAttrs {

 						var appended bool
-						if htmlAttr.Key == "rel" && (addNoFollow || addNoReferrer) {
+						if htmlAttr.Key == "rel" && addNoFollow {

-							if addNoFollow && !strings.Contains(htmlAttr.Val, "nofollow") {
+							if strings.Contains(htmlAttr.Val, "nofollow") {
+								noFollowFound = true
+								tmpAttrs = append(tmpAttrs, htmlAttr)
+								appended = true
+							} else {
 								htmlAttr.Val += " nofollow"
+								noFollowFound = true
+								tmpAttrs = append(tmpAttrs, htmlAttr)
+								appended = true
 							}
-							if addNoReferrer && !strings.Contains(htmlAttr.Val, "noreferrer") {
-								htmlAttr.Val += " noreferrer"
-							}
-							noFollowFound = addNoFollow
-							noReferrerFound = addNoReferrer
-							tmpAttrs = append(tmpAttrs, htmlAttr)
-							appended = true
 						}

 						if elementName == "a" && htmlAttr.Key == "target" {
@@ -582,22 +424,14 @@ func (p *Policy) sanitizeAttrs(
 							tmpAttrs = append(tmpAttrs, htmlAttr)
 						}
 					}
-					if noFollowFound || noReferrerFound || targetBlankFound {
+					if noFollowFound || targetBlankFound {
 						cleanAttrs = tmpAttrs
 					}

-					if (addNoFollow && !noFollowFound) || (addNoReferrer && !noReferrerFound) {
+					if addNoFollow && !noFollowFound {
 						rel := html.Attribute{}
 						rel.Key = "rel"
-						if addNoFollow {
-							rel.Val = "nofollow"
-						}
-						if addNoReferrer {
-							if rel.Val != "" {
-								rel.Val += " "
-							}
-							rel.Val += "noreferrer"
-						}
+						rel.Val = "nofollow"
 						cleanAttrs = append(cleanAttrs, rel)
 					}

@@ -667,95 +501,8 @@ func (p *Policy) sanitizeAttrs(
 	return cleanAttrs
 }

-func (p *Policy) sanitizeStyles(attr html.Attribute, elementName string) html.Attribute {
-	sps := p.elsAndStyles[elementName]
-	if len(sps) == 0 {
-		sps = map[string]stylePolicy{}
-		// check for any matching elements, if we don't already have a policy found
-		// if multiple matches are found they will be overwritten, it's best
-		// to not have overlapping matchers
-		for regex, policies := range p.elsMatchingAndStyles {
-			if regex.MatchString(elementName) {
-				for k, v := range policies {
-					sps[k] = v
-				}
-			}
-		}
-	}
-
-	//Add semi-colon to end to fix parsing issue
-	if len(attr.Val) > 0 && attr.Val[len(attr.Val)-1] != ';' {
-		attr.Val = attr.Val + ";"
-	}
-	decs, err := cssparser.ParseDeclarations(attr.Val)
-	if err != nil {
-		attr.Val = ""
-		return attr
-	}
-	clean := []string{}
-	prefixes := []string{"-webkit-", "-moz-", "-ms-", "-o-", "mso-", "-xv-", "-atsc-", "-wap-", "-khtml-", "prince-", "-ah-", "-hp-", "-ro-", "-rim-", "-tc-"}
-
-	for _, dec := range decs {
-		addedProperty := false
-		tempProperty := strings.ToLower(dec.Property)
-		tempValue := removeUnicode(strings.ToLower(dec.Value))
-		for _, i := range prefixes {
-			tempProperty = strings.TrimPrefix(tempProperty, i)
-		}
-		if sp, ok := sps[tempProperty]; ok {
-			if sp.handler != nil {
-				if sp.handler(tempValue) {
-					clean = append(clean, dec.Property+": "+dec.Value)
-					addedProperty = true
-				}
-			} else if len(sp.enum) > 0 {
-				if stringInSlice(tempValue, sp.enum) {
-					clean = append(clean, dec.Property+": "+dec.Value)
-					addedProperty = true
-				}
-			} else if sp.regexp != nil {
-				if sp.regexp.MatchString(tempValue) {
-					clean = append(clean, dec.Property+": "+dec.Value)
-					addedProperty = true
-				}
-				continue
-			}
-		}
-		if sp, ok := p.globalStyles[tempProperty]; ok && !addedProperty {
-			if sp.handler != nil {
-				if sp.handler(tempValue) {
-					clean = append(clean, dec.Property+": "+dec.Value)
-				}
-			} else if len(sp.enum) > 0 {
-				if stringInSlice(tempValue, sp.enum) {
-					clean = append(clean, dec.Property+": "+dec.Value)
-				}
-			} else if sp.regexp != nil {
-				if sp.regexp.MatchString(tempValue) {
-					clean = append(clean, dec.Property+": "+dec.Value)
-				}
-				continue
-			}
-		}
-	}
-	if len(clean) > 0 {
-		attr.Val = strings.Join(clean, "; ")
-	} else {
-		attr.Val = ""
-	}
-	return attr
-}
-
 func (p *Policy) allowNoAttrs(elementName string) bool {
 	_, ok := p.setOfElementsAllowedWithoutAttrs[elementName]
-	if !ok {
-		for _, r := range p.setOfElementsMatchingAllowedWithoutAttrs {
-			if r.MatchString(elementName) {
-				ok = true
-				break
-			}
-		}
-	}
 	return ok
 }

@@ -814,16 +561,6 @@ func linkable(elementName string) bool {
 	}
 }

-// stringInSlice returns true if needle exists in haystack
-func stringInSlice(needle string, haystack []string) bool {
-	for _, straw := range haystack {
-		if strings.ToLower(straw) == strings.ToLower(needle) {
-			return true
-		}
-	}
-	return false
-}
-
 func isDataAttribute(val string) bool {
 	if !dataAttribute.MatchString(val) {
 		return false
@@ -842,48 +579,3 @@ func isDataAttribute(val string) bool {
 	}
 	return true
 }
-
-func removeUnicode(value string) string {
-	substitutedValue := value
-	currentLoc := cssUnicodeChar.FindStringIndex(substitutedValue)
-	for currentLoc != nil {
-
-		character := substitutedValue[currentLoc[0]+1 : currentLoc[1]]
-		character = strings.TrimSpace(character)
-		if len(character) < 4 {
-			character = strings.Repeat("0", 4-len(character)) + character
-		} else {
-			for len(character) > 4 {
-				if character[0] != '0' {
-					character = ""
-					break
-				} else {
-					character = character[1:]
-				}
-			}
-		}
-		character = "\\u" + character
-		translatedChar, err := strconv.Unquote(`"` + character + `"`)
-		translatedChar = strings.TrimSpace(translatedChar)
-		if err != nil {
-			return ""
-		}
-		substitutedValue = substitutedValue[0:currentLoc[0]] + translatedChar + substitutedValue[currentLoc[1]:]
-		currentLoc = cssUnicodeChar.FindStringIndex(substitutedValue)
-	}
-	return substitutedValue
-}
-
-func (p *Policy) matchRegex(elementName string) (map[string]attrPolicy, bool) {
-	aps := make(map[string]attrPolicy, 0)
-	matched := false
-	for regex, attrs := range p.elsMatchingAndAttrs {
-		if regex.MatchString(elementName) {
-			matched = true
-			for k, v := range attrs {
-				aps[k] = v
-			}
-		}
-	}
-	return aps, matched
-}