From cf07089d00eb13a80ecb699cbb0bba81f4702f0c Mon Sep 17 00:00:00 2001 From: ccd0 Date: Mon, 4 May 2015 02:31:46 -0700 Subject: [PATCH] Implement sandboxing for sauce links. --- Gruntfile.coffee | 7 ++++--- src/General/Config.coffee | 2 +- src/General/Globals.coffee | 3 +++ src/General/html/Features/Sandbox.html | 16 ++++++++++++++++ src/General/html/Settings/Sauce.html | 1 + src/Images/Sauce.coffee | 12 +++++++++--- src/Linkification/Embedding.coffee | 2 +- 7 files changed, 35 insertions(+), 8 deletions(-) create mode 100644 src/General/html/Features/Sandbox.html diff --git a/Gruntfile.coffee b/Gruntfile.coffee index ba1d5a8c3..3cbf48cb0 100755 --- a/Gruntfile.coffee +++ b/Gruntfile.coffee @@ -16,13 +16,14 @@ module.exports = (grunt) -> parts = [] text = template while text - if part = text.match /^[^{}]+(?!{)/ + if part = text.match /^(?:[^{}\\]|\\.)+(?!{)/ text = text[part[0].length..] - context = (context + part[0]) + unescaped = part[0].replace /\\(.)/g, '$1' + context = (context + unescaped) .replace(/(=['"])[^'"<>]*/g, '$1') .replace(/(<\w+)( [\w-]+((?=[ >])|=''|=""))*/g, '$1') .replace(/^([^'"<>]+|<\/?\w+>)*/, '') - parts.push json part[0] + parts.push json unescaped else if part = text.match /^([^}]){([^}`]*)}/ text = text[part[0].length..] unless context is '' or (part[1] is '$' and /\=['"]$/.test context) or part[1] is '?' diff --git a/src/General/Config.coffee b/src/General/Config.coffee index d30f2cf91..2d9040cbc 100755 --- a/src/General/Config.coffee +++ b/src/General/Config.coffee @@ -669,7 +669,7 @@ Config = sauces: """ https://www.google.com/searchbyimage?image_url=%IMG http://iqdb.org/?url=%IMG - http://eye.swfchan.com/search/?q=%name;types:swf + http://eye.swfchan.com/search/?q=%name;types:swf;sandbox #//tineye.com/search?url=%IMG #https://www.yandex.com/images/search?rpt=imageview&img_url=%IMG #//saucenao.com/search.php?url=%IMG diff --git a/src/General/Globals.coffee b/src/General/Globals.coffee index 82bcf0278..43cd70ca4 100755 --- a/src/General/Globals.coffee +++ b/src/General/Globals.coffee @@ -19,3 +19,6 @@ E.cat = (templates) -> html = '' html += x.innerHTML for x in templates html + +E.url = (content) -> + "data:text/html;charset=utf-8,#{encodeURIComponent content.innerHTML}" diff --git a/src/General/html/Features/Sandbox.html b/src/General/html/Features/Sandbox.html new file mode 100644 index 000000000..bc8ddbd52 --- /dev/null +++ b/src/General/html/Features/Sandbox.html @@ -0,0 +1,16 @@ + +[sb] ${url} + + + + diff --git a/src/General/html/Settings/Sauce.html b/src/General/html/Settings/Sauce.html index ff1c76644..bf13382a3 100755 --- a/src/General/html/Settings/Sauce.html +++ b/src/General/html/Settings/Sauce.html @@ -3,6 +3,7 @@
You can specify a display text by appending ;text:[text] to the URL.
You can specify the applicable boards by appending ;boards:[board1],[board2].
You can specify the applicable file types by appending ;types:[extension1],[extension2].
+
You can open links with scripts and popups disabled by appending ;sandbox.