Changeset 3751269

Timestamp:

10/17/2026 12:04:52 AM (37 hours ago)

Author:

WayneAllen

Message:

Escape autolink href and title attributes to prevent XSS

Location:

postie/trunk

Files:

• GEMINI.md (modified) (1 diff)
• lib/autolink.php (modified) (4 diffs)

postie/trunk/GEMINI.md

@@ -136 +136 @@
     *   Run `deploy\deploy.cmd` (or `deploy/deploy.sh` on Unix-like environments) to automatically generate the `readme.txt` and build/package the release assets.
 5.  **Source Control**:
-    *   Commit all finalized files locally: `git commit -am "Prepare <version> release"`
-    *   Create a release tag: `git tag -a <version> -m "Release <version>"`
+    *   Commit all finalized files: `svn commit -m "Prepare <version> release"`
+    *   Create a release tag: `svn copy ^/postie/trunk ^/postie/tags/<version> -m "Release <version>"`
 6.  **Public Announcements**:
     *   Add a release post on the official Postie site: `http://postieplugin.com/`

postie/trunk/lib/autolink.php

@@ -148 +148 @@
                 if (preg_match('/^([a-z0-9\-\.\/\-_%~!?=,:;&+*#@\(\)\$°’;]+)/i', $post, $matches)) {
 
-                    $url = $hit . $matches[1];
-
-                    $cursor += strlen($url) + strlen($pre_hit);
+                    $raw_url = $hit . $matches[1];
+
+                    $cursor += strlen($raw_url) + strlen($pre_hit);
                     $buffer .= $pre_hit;
 
-                    $url = html_entity_decode($url);
+                    $url = html_entity_decode($raw_url);
+
+                    if (preg_match('/[\s<>"\\\\\x00-\x1f\x7f]/', $url)) {
+                        $buffer .= $raw_url;
+                        continue;
+                    }
 
                     #
@@ -202 +207 @@
                         if (!preg_match("!^(http|https)://{$display_quoted}$!i", $link_url)) {
 
-                            $currentTagfill .= ' title="' . $link_url . '"';
+                            $currentTagfill .= ' title="' . htmlspecialchars($link_url, ENT_QUOTES, 'UTF-8') . '"';
                         }
                     }
@@ -237 +242 @@
                         DebugEcho("autolink_do: linkifying $link_url");
                         try {
-                            $link_html = apply_filters('postie_bare_link', "<a href=\"{$link_url}\"$currentTagfill>{$display_url_enc}</a>", $link_url, false);
+                            $link_html = apply_filters('postie_bare_link', "<a href=\"{$link_url_enc}\"$currentTagfill>{$display_url_enc}</a>", $link_url, false);
                         } catch (Throwable $exc) {
                             EchoError('postie_bare_link: ' . $exc->getMessage() . "\n" . $exc->getTraceAsString());
@@ -426 +431 @@
                 $cursor += strlen($pre) + strlen($hit);
                 $buffer .= $pre;
-                $buffer .= "<a href=\"mailto:$hit\" $tagfill>$hit</a>";
+                $hit_enc = htmlspecialchars($hit);
+                $buffer .= "<a href=\"mailto:$hit_enc\" $tagfill>$hit_enc</a>";
             }
         }