diff --git a/src/autolinker.ts b/src/autolinker.ts
index b529dc3c..f83a31f5 100644
--- a/src/autolinker.ts
+++ b/src/autolinker.ts
@@ -466,6 +466,12 @@ export default class Autolinker {
*/
private readonly sanitizeHtml: boolean = false; // default value just to get the above doc comment in the ES5 output and documentation generator
+ /**
+ * @cfg {Boolean} [sanitizeHtml=false]
+ * removes all directional override characters from input string
+ */
+ private readonly stripDirectionalCharacters: boolean = false;
+
/**
* @private
* @property {Autolinker.AnchorTagBuilder} tagBuilder
@@ -497,6 +503,7 @@ export default class Autolinker {
? cfg.decodePercentEncoding
: this.decodePercentEncoding;
this.sanitizeHtml = cfg.sanitizeHtml || false;
+ this.stripDirectionalCharacters = cfg.stripDirectionalCharacters || false;
// Validate the value of the `mention` cfg
const mention = this.mention;
@@ -783,6 +790,10 @@ export default class Autolinker {
textOrHtml = textOrHtml.replace(//g, '>');
}
+ if (this.stripDirectionalCharacters) {
+ textOrHtml = this.stripUnsafeCharacters(textOrHtml);
+ }
+
let matches = this.parse(textOrHtml),
newHtml: string[] = [],
lastIndex = 0;
@@ -854,6 +865,16 @@ export default class Autolinker {
return tagBuilder;
}
+
+ /**
+ * Strips characters considered as unsafe
+ * SNYK-AUTOLINKER-2438289
+ * @param text
+ * @private
+ */
+ private stripUnsafeCharacters(text: string) {
+ return text.replace(/[\u202a-\u202e\u200e-\u200f]/g, '');
+ }
}
/**
@@ -944,6 +965,7 @@ export interface AutolinkerConfig {
context?: any;
sanitizeHtml?: boolean;
decodePercentEncoding?: boolean;
+ stripDirectionalCharacters?: boolean;
}
export type UrlsConfig = boolean | UrlsConfigObj;
diff --git a/tests/autolinker-directional.spec.ts b/tests/autolinker-directional.spec.ts
new file mode 100644
index 00000000..087b740a
--- /dev/null
+++ b/tests/autolinker-directional.spec.ts
@@ -0,0 +1,23 @@
+import Autolinker from '../src/autolinker';
+
+describe('Autolinker strip directional characters check -', () => {
+ const autolinker = new Autolinker({
+ newWindow: false,
+ stripDirectionalCharacters: true,
+ stripPrefix: {
+ www: false,
+ },
+ });
+
+ it('should strip out character direction override unicodes', () => {
+ expect(autolinker.link('foo.combar.com')).toBe(
+ 'foo.combar.com'
+ );
+ expect(autolinker.link('foo.com\u202Ebar.com')).toBe(
+ 'foo.combar.com'
+ );
+ expect(autolinker.link('foo.com\u202abar.com')).toBe(
+ 'foo.combar.com'
+ );
+ });
+});