IBX-8891: xml link validator in rich text does not allow to use "tel:" links #244
Conversation
| <a:documentation>Identifies a link target with a URI</a:documentation> | ||
| <choice> | ||
| <data type="string"> | ||
| <param name="pattern">(https?://|mailto:|ezcontent://|ezlocation://|ezremote://|ezurl://|tel:|/|#).+</param> |
There was a problem hiding this comment.
The original fix for ibexa-sa-2024-005-persistent-xss-in-richtext also checks for the existence of <, > and '"
In order to check for this in the reg-ex, I need to use Negative Lookahead, but adding (?!foobar) in the regex is not accepted by the schema validator, ie:
<param name="pattern">(?!.*foobar)(https?://|mailto:|ezcontent://|ezlocation://|ezremote://|ezurl://|tel:|/|#).+</param>-
It returns erros like:
Validation of XML content failed: Fatal error in 0:0: failed to compile: xmlFAParseAtom: expecting ')'
Validation of XML content failed: Fatal error in 0:0: failed to compile: xmlFAParseRegExp: extra characters
regex engine do not support lookahead?
There was a problem hiding this comment.
The check for <, > and '" is uneeded as urls are correctly URL encoded when sent to front-end anyway
|
We'll fix this using schematron anyway, see https://issues.ibexa.co/browse/IBX-8891?focusedId=286159&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-286159 |
vidarl
deleted the
IBX-8891_XML_link_validator_in_rich-text_does_not_allow_to_use_tel_links
branch
|
Created #245 which updates schematron schema instead |
This is an attempt to fix ibexa-sa-2024-005-persistent-xss-in-richtext without touching original docbook schema.
However, there are some challenges, see review comment by author
TODO:
$ composer fix-cs).