Changeset 27 in code

Timestamp:

Nov 21, 2016, 10:36:58 PM (9 years ago)

Author:

alex

Message:

Fix #13

File:

• trunk/morty.go (modified) (5 diffs)

trunk/morty.go

@@ -12 +12 @@
         "log"
         "net/url"
+        "path"
         "regexp"
         "strings"
@@ -31 +32 @@
 }
 
-var CSS_URL_REGEXP *regexp.Regexp = regexp.MustCompile("url\\((['\"]?)([\u0009\u0021\u0023-\u0026\u0028\u002a-\u007E]+)(['\"]?)\\)?")
+var CSS_URL_REGEXP *regexp.Regexp = regexp.MustCompile("url\\((['\"]?)[ \\t\\f]*([\u0009\u0021\u0023-\u0026\u0028\u002a-\u007E]+)(['\"]?)\\)?")
 
 var UNSAFE_ELEMENTS [][]byte = [][]byte{
@@ -382 +383 @@
                                                 if bytes.Equal(attr[0], []byte("action")) {
                                                         formURL, _ = url.Parse(string(attr[1]))
-                                                        formURL = mergeURIs(rc.BaseURL, formURL)
+                                                        mergeURIs(rc.BaseURL, formURL)
                                                         break
                                                 }
@@ -526 +527 @@
 }
 
-func mergeURIs(u1, u2 *url.URL) (*url.URL) {
-        return u1.ResolveReference(u2)
+func mergeURIs(u1, u2 *url.URL) {
+        if u2.Scheme == "" || u2.Scheme == "//" {
+                u2.Scheme = u1.Scheme
+        }
+        if u2.Host == "" && u1.Path != "" {
+                u2.Host = u1.Host
+                if len(u2.Path) == 0 || u2.Path[0] != '/' {
+                        u2.Path = path.Join(u1.Path[:strings.LastIndexByte(u1.Path, byte('/'))], u2.Path)
+                }
+        }
 }
 
 func (rc *RequestConfig) ProxifyURI(uri string) (string, error) {
-        // remove javascript protocol
-        if strings.HasPrefix(uri, "javascript:") {
-                return "", nil
-        }
         // TODO check malicious data: - e.g. data:script
         if strings.HasPrefix(uri, "data:") {
@@ -548 +553 @@
                 return "", err
         }
-        u = mergeURIs(rc.BaseURL, u)
+        mergeURIs(rc.BaseURL, u)
 
         uri = u.String()