decentraland / events / 29952657091

67%

push

github

fix: re-moderate approved events on content edits and sanitize description output (#986)

two related hardening changes for the event description path, which the
unity client renders as textmeshpro rich text (no html, no markdown), so a
`<link="target">` tag becomes a clickable link that reaches an unrestricted
`Application.OpenURL(target)` on the viewer's machine.

- reset approval on content edits: in `updateEvent`, when a content field
  (name, description, image, x, y, server) changes on an already-approved
  event, flip `approved` back to false, clear `approved_by`, and drop
  highlighted/trending so it re-enters moderation. skipped when the actor
  can approve (admin / isAdmin / ApproveAnyEvent, or the owner with
  ApproveOwnEvent) since their edit is itself a review. closes the
  edit-after-approval bypass.

- sanitize description output: `sanitizeEventDescription` keeps `<link>`
  tags whose target is an http(s) url — the legitimate use case — and
  strips links to any other scheme (file://, smb://, decentraland://,
  javascript:, data:, ...) plus every other markup tag, dropping both sides
  of a stripped link so no orphan tag remains. http(s) targets must also
  resolve (via the WHATWG URL parser, so obfuscated IPs can't slip past) to
  a public host: loopback / private / link-local (incl. the
  169.254.169.254 cloud-metadata endpoint) / internal / localhost links are
  stripped too. applied in `model.ts` `toPublic`. stripping rather than
  html-escaping keeps the text clean, since tmp does not decode entities.
  markdown and "5 < 10" survive.

covered by unit tests for the link-aware strip helper (safe/unsafe/mixed/
ambiguous cases), the toPublic sanitization, and the re-moderation gate
across the owner / editor / moderator permission matrix. also updates the
updateEvent integration test: after an owner edits a content field the
event is re-queued (approved -> false), so the persistence read-back is now
done as the authenticated owner rathe... (continued)

684 of 938 branches covered (72.92%)

Branch coverage included in aggregate %.

222 of 232 new or added lines in 3 files covered. (95.69%)

3785 of 5723 relevant lines covered (66.14%)

6.88 hits per line