diff --git a/src/autolinker.ts b/src/autolinker.ts index b529dc3c..f83a31f5 100644 --- a/src/autolinker.ts +++ b/src/autolinker.ts @@ -466,6 +466,12 @@ export default class Autolinker { */ private readonly sanitizeHtml: boolean = false; // default value just to get the above doc comment in the ES5 output and documentation generator + /** + * @cfg {Boolean} [sanitizeHtml=false] + * removes all directional override characters from input string + */ + private readonly stripDirectionalCharacters: boolean = false; + /** * @private * @property {Autolinker.AnchorTagBuilder} tagBuilder @@ -497,6 +503,7 @@ export default class Autolinker { ? cfg.decodePercentEncoding : this.decodePercentEncoding; this.sanitizeHtml = cfg.sanitizeHtml || false; + this.stripDirectionalCharacters = cfg.stripDirectionalCharacters || false; // Validate the value of the `mention` cfg const mention = this.mention; @@ -783,6 +790,10 @@ export default class Autolinker { textOrHtml = textOrHtml.replace(//g, '>'); } + if (this.stripDirectionalCharacters) { + textOrHtml = this.stripUnsafeCharacters(textOrHtml); + } + let matches = this.parse(textOrHtml), newHtml: string[] = [], lastIndex = 0; @@ -854,6 +865,16 @@ export default class Autolinker { return tagBuilder; } + + /** + * Strips characters considered as unsafe + * SNYK-AUTOLINKER-2438289 + * @param text + * @private + */ + private stripUnsafeCharacters(text: string) { + return text.replace(/[\u202a-\u202e\u200e-\u200f]/g, ''); + } } /** @@ -944,6 +965,7 @@ export interface AutolinkerConfig { context?: any; sanitizeHtml?: boolean; decodePercentEncoding?: boolean; + stripDirectionalCharacters?: boolean; } export type UrlsConfig = boolean | UrlsConfigObj; diff --git a/tests/autolinker-directional.spec.ts b/tests/autolinker-directional.spec.ts new file mode 100644 index 00000000..087b740a --- /dev/null +++ b/tests/autolinker-directional.spec.ts @@ -0,0 +1,23 @@ +import Autolinker from '../src/autolinker'; + +describe('Autolinker strip directional characters check -', () => { + const autolinker = new Autolinker({ + newWindow: false, + stripDirectionalCharacters: true, + stripPrefix: { + www: false, + }, + }); + + it('should strip out character direction override unicodes', () => { + expect(autolinker.link('foo.combar.com')).toBe( + 'foo.combar.com' + ); + expect(autolinker.link('foo.com\u202Ebar.com')).toBe( + 'foo.combar.com' + ); + expect(autolinker.link('foo.com\u202abar.com')).toBe( + 'foo.combar.com' + ); + }); +});