decentraland / events / 30384530012

66%

Build Type

push

github

Committed by web-flow

Commit Message

fix: fail closed on malformed <link> openers in sanitizeEventDescription (#1002)

* fix: fail closed on malformed <link> openers in sanitizeEventDescription

the markup-tag regex body is now `[^>]*` instead of `[^<>]*`, so a malformed
opener that embeds a nested tag (`<link="javascript:…"<b>`) is captured as one
span up to the first `>` and rejected whole. previously the outer `<link…`
fragment went unmatched and, after the inner tag was stripped, the leftover
pieces re-assembled into a live `<link="javascript:alert(1)">` opener,
reintroducing the Application.OpenURL vector the sanitizer is meant to close.
prose like `5 < 10 > 3` and markdown are still preserved (a `<` not immediately
followed by a letter is not a tag).

regression test added for the exact shape.

* fix: sanitize descriptions to a fixed point so stripped markup can't reassemble

a single strip pass can leave a `<` (from before a removed tag) fused to the
following text, forming a new `<link="javascript:…">` opener the pass never
revisits (`<<b>link="javascript:alert(1)">click</link>`). re-run the strip to a
fixed point; each changing pass strictly shortens the string so it converges,
and at the stable point only validated-safe links remain. fail closed (strip
every angle bracket) if a pathological input doesn't stabilize within the cap.

regression test added for the reassembly shape.

* fix: neutralize unclosed <link openers left by the fixed-point strip

a stripped tag can leave an UNCLOSED `<link=…` fragment (its `>` was consumed by
the removed tag), which a stable pass leaves in place. rather than rely on TMP
needing the `>`, stripPass now also drops the leading `<` of any `<link` with no
closing `>` before the next `<`/end, folded into the same fixed-point loop; safe
links keep their `>` and are untouched.

validated with a 1M-input fuzz harness: no complete unsafe <link> tag ever
survives, output is stable + idempotent, and legitimate safe links are preserved.
regression test ad... (continued)

Coverage Stats

698 of 954 branches covered (73.17%)

Branch coverage included in aggregate %.

72 of 73 new or added lines in 1 file covered. (98.63%)

1 existing line in 1 file now uncovered.

3830 of 5770 relevant lines covered (66.38%)

7.17 hits per line