mirror of https://github.com/TryGhost/Ghost.git
Updated to use slugify method from SDK for safe string
refs #10618 - Updated lib safe string security method
This commit is contained in:
Rish
Rishabh Garg
parent
65ee0f95c4
commit
a4f4a00cc4
|
|
@ -1,38 +1,11 @@
|
|||
const unidecode = require('unidecode'),
|
||||
_ = require('lodash');
|
||||
const _ = require('lodash');
|
||||
const slugify = require('@tryghost/string').slugify;
|
||||
|
||||
module.exports.safe = function safe(string, options) {
|
||||
options = options || {};
|
||||
|
||||
if (string === null) {
|
||||
string = '';
|
||||
}
|
||||
|
||||
// Handle the £ symbol separately, since it needs to be removed before the unicode conversion.
|
||||
string = string.replace(/£/g, '-');
|
||||
|
||||
// Remove non ascii characters
|
||||
string = unidecode(string);
|
||||
|
||||
// Replace URL reserved chars: `@:/?#[]!$&()*+,;=` as well as `\%<>|^~£"{}` and \`
|
||||
string = string.replace(/(\s|\.|@|:|\/|\?|#|\[|\]|!|\$|&|\(|\)|\*|\+|,|;|=|\\|%|<|>|\||\^|~|"|\{|\}|`|–|—)/g, '-')
|
||||
// Remove apostrophes
|
||||
.replace(/'/g, '')
|
||||
// Make the whole thing lowercase
|
||||
.toLowerCase();
|
||||
|
||||
// We do not need to make the following changes when importing data
|
||||
let opts = {requiredChangesOnly: true};
|
||||
if (!_.has(options, 'importing') || !options.importing) {
|
||||
// Convert 2 or more dashes into a single dash
|
||||
string = string.replace(/-+/g, '-')
|
||||
// Remove trailing dash
|
||||
.replace(/-$/, '')
|
||||
// Remove any dashes at the beginning
|
||||
.replace(/^-/, '');
|
||||
opts.requiredChangesOnly = false;
|
||||
}
|
||||
|
||||
// Handle whitespace at the beginning or end.
|
||||
string = string.trim();
|
||||
|
||||
return string;
|
||||
return slugify(string, opts);
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1083,19 +1083,11 @@ ghostBookshelf.Model = ghostBookshelf.Model.extend({
|
|||
});
|
||||
};
|
||||
|
||||
const removeInvisibleUnicode = (str) => {
|
||||
// taken from https://github.com/slevithan/xregexp/blob/20ab3d7a59035649327b8acb1cf372afb5f71f83/tools/output/categories.js#L6
|
||||
const invisibleLetters = /[\0-\x1F\x7F-\x9F\xAD\u0378\u0379\u0380-\u0383\u038B\u038D\u03A2\u0530\u0557\u0558\u058B\u058C\u0590\u05C8-\u05CF\u05EB-\u05EE\u05F5-\u0605\u061C\u061D\u06DD\u070E\u070F\u074B\u074C\u07B2-\u07BF\u07FB\u07FC\u082E\u082F\u083F\u085C\u085D\u085F\u086B-\u089F\u08B5\u08BE-\u08D2\u08E2\u0984\u098D\u098E\u0991\u0992\u09A9\u09B1\u09B3-\u09B5\u09BA\u09BB\u09C5\u09C6\u09C9\u09CA\u09CF-\u09D6\u09D8-\u09DB\u09DE\u09E4\u09E5\u09FF\u0A00\u0A04\u0A0B-\u0A0E\u0A11\u0A12\u0A29\u0A31\u0A34\u0A37\u0A3A\u0A3B\u0A3D\u0A43-\u0A46\u0A49\u0A4A\u0A4E-\u0A50\u0A52-\u0A58\u0A5D\u0A5F-\u0A65\u0A77-\u0A80\u0A84\u0A8E\u0A92\u0AA9\u0AB1\u0AB4\u0ABA\u0ABB\u0AC6\u0ACA\u0ACE\u0ACF\u0AD1-\u0ADF\u0AE4\u0AE5\u0AF2-\u0AF8\u0B00\u0B04\u0B0D\u0B0E\u0B11\u0B12\u0B29\u0B31\u0B34\u0B3A\u0B3B\u0B45\u0B46\u0B49\u0B4A\u0B4E-\u0B55\u0B58-\u0B5B\u0B5E\u0B64\u0B65\u0B78-\u0B81\u0B84\u0B8B-\u0B8D\u0B91\u0B96-\u0B98\u0B9B\u0B9D\u0BA0-\u0BA2\u0BA5-\u0BA7\u0BAB-\u0BAD\u0BBA-\u0BBD\u0BC3-\u0BC5\u0BC9\u0BCE\u0BCF\u0BD1-\u0BD6\u0BD8-\u0BE5\u0BFB-\u0BFF\u0C0D\u0C11\u0C29\u0C3A-\u0C3C\u0C45\u0C49\u0C4E-\u0C54\u0C57\u0C5B-\u0C5F\u0C64\u0C65\u0C70-\u0C77\u0C8D\u0C91\u0CA9\u0CB4\u0CBA\u0CBB\u0CC5\u0CC9\u0CCE-\u0CD4\u0CD7-\u0CDD\u0CDF\u0CE4\u0CE5\u0CF0\u0CF3-\u0CFF\u0D04\u0D0D\u0D11\u0D45\u0D49\u0D50-\u0D53\u0D64\u0D65\u0D80\u0D81\u0D84\u0D97-\u0D99\u0DB2\u0DBC\u0DBE\u0DBF\u0DC7-\u0DC9\u0DCB-\u0DCE\u0DD5\u0DD7\u0DE0-\u0DE5\u0DF0\u0DF1\u0DF5-\u0E00\u0E3B-\u0E3E\u0E5C-\u0E80\u0E83\u0E85\u0E86\u0E89\u0E8B\u0E8C\u0E8E-\u0E93\u0E98\u0EA0\u0EA4\u0EA6\u0EA8\u0EA9\u0EAC\u0EBA\u0EBE\u0EBF\u0EC5\u0EC7\u0ECE\u0ECF\u0EDA\u0EDB\u0EE0-\u0EFF\u0F48\u0F6D-\u0F70\u0F98\u0FBD\u0FCD\u0FDB-\u0FFF\u10C6\u10C8-\u10CC\u10CE\u10CF\u1249\u124E\u124F\u1257\u1259\u125E\u125F\u1289\u128E\u128F\u12B1\u12B6\u12B7\u12BF\u12C1\u12C6\u12C7\u12D7\u1311\u1316\u1317\u135B\u135C\u137D-\u137F\u139A-\u139F\u13F6\u13F7\u13FE\u13FF\u169D-\u169F\u16F9-\u16FF\u170D\u1715-\u171F\u1737-\u173F\u1754-\u175F\u176D\u1771\u1774-\u177F\u17DE\u17DF\u17EA-\u17EF\u17FA-\u17FF\u180E\u180F\u181A-\u181F\u1879-\u187F\u18AB-\u18AF\u18F6-\u18FF\u191F\u192C-\u192F\u193C-\u193F\u1941-\u1943\u196E\u196F\u1975-\u197F\u19AC-\u19AF\u19CA-\u19CF\u19DB-\u19DD\u1A1C\u1A1D\u1A5F\u1A7D\u1A7E\u1A8A-\u1A8F\u1A9A-\u1A9F\u1AAE\u1AAF\u1ABF-\u1AFF\u1B4C-\u1B4F\u1B7D-\u1B7F\u1BF4-\u1BFB\u1C38-\u1C3A\u1C4A-\u1C4C\u1C89-\u1C8F\u1CBB\u1CBC\u1CC8-\u1CCF\u1CFA-\u1CFF\u1DFA\u1F16\u1F17\u1F1E\u1F1F\u1F46\u1F47\u1F4E\u1F4F\u1F58\u1F5A\u1F5C\u1F5E\u1F7E\u1F7F\u1FB5\u1FC5\u1FD4\u1FD5\u1FDC\u1FF0\u1FF1\u1FF5\u1FFF\u200B-\u200F\u202A-\u202E\u2060-\u206F\u2072\u2073\u208F\u209D-\u209F\u20C0-\u20CF\u20F1-\u20FF\u218C-\u218F\u2427-\u243F\u244B-\u245F\u2B74\u2B75\u2B96\u2B97\u2BC9\u2BFF\u2C2F\u2C5F\u2CF4-\u2CF8\u2D26\u2D28-\u2D2C\u2D2E\u2D2F\u2D68-\u2D6E\u2D71-\u2D7E\u2D97-\u2D9F\u2DA7\u2DAF\u2DB7\u2DBF\u2DC7\u2DCF\u2DD7\u2DDF\u2E4F-\u2E7F\u2E9A\u2EF4-\u2EFF\u2FD6-\u2FEF\u2FFC-\u2FFF\u3040\u3097\u3098\u3100-\u3104\u3130\u318F\u31BB-\u31BF\u31E4-\u31EF\u321F\u32FF\u4DB6-\u4DBF\u9FF0-\u9FFF\uA48D-\uA48F\uA4C7-\uA4CF\uA62C-\uA63F\uA6F8-\uA6FF\uA7BA-\uA7F6\uA82C-\uA82F\uA83A-\uA83F\uA878-\uA87F\uA8C6-\uA8CD\uA8DA-\uA8DF\uA954-\uA95E\uA97D-\uA97F\uA9CE\uA9DA-\uA9DD\uA9FF\uAA37-\uAA3F\uAA4E\uAA4F\uAA5A\uAA5B\uAAC3-\uAADA\uAAF7-\uAB00\uAB07\uAB08\uAB0F\uAB10\uAB17-\uAB1F\uAB27\uAB2F\uAB66-\uAB6F\uABEE\uABEF\uABFA-\uABFF\uD7A4-\uD7AF\uD7C7-\uD7CA\uD7FC-\uF8FF\uFA6E\uFA6F\uFADA-\uFAFF\uFB07-\uFB12\uFB18-\uFB1C\uFB37\uFB3D\uFB3F\uFB42\uFB45\uFBC2-\uFBD2\uFD40-\uFD4F\uFD90\uFD91\uFDC8-\uFDEF\uFDFE\uFDFF\uFE1A-\uFE1F\uFE53\uFE67\uFE6C-\uFE6F\uFE75\uFEFD-\uFF00\uFFBF-\uFFC1\uFFC8\uFFC9\uFFD0\uFFD1\uFFD8\uFFD9\uFFDD-\uFFDF\uFFE7\uFFEF-\uFFFB\uFFFE\uFFFF]/g; // eslint-disable-line no-control-regex
|
||||
return str.replace(invisibleLetters, '');
|
||||
};
|
||||
|
||||
base = removeInvisibleUnicode(base);
|
||||
slug = security.string.safe(base, options);
|
||||
|
||||
// the slug may never be longer than the allowed limit of 191 chars, but should also
|
||||
// take the counter into count. We reduce a too long slug to 185 so we're always on the
|
||||
// safe side, also in terms of checking for existing slugs already.
|
||||
slug = security.string.safe(base, options);
|
||||
|
||||
if (slug.length > 185) {
|
||||
// CASE: don't cut the slug on import
|
||||
if (!_.has(options, 'importing') || !options.importing) {
|
||||
|
|
|
|||
|
|
@ -102,7 +102,7 @@ describe('Models: base', function () {
|
|||
|
||||
it('contains invisible unicode', function () {
|
||||
Model.findOne.resolves(false);
|
||||
security.string.safe.withArgs('abc').returns('abc');
|
||||
security.string.safe.withArgs('abc\u0008').returns('abc');
|
||||
|
||||
return models.Base.Model.generateSlug(Model, 'abc\u0008', options)
|
||||
.then((slug) => {
|
||||
|
|
|
|||
|
|
@ -43,6 +43,7 @@
|
|||
"@tryghost/helpers": "1.1.2",
|
||||
"@tryghost/members-ssr": "0.1.5",
|
||||
"@tryghost/members-theme-bindings": "^0.1.0",
|
||||
"@tryghost/string": "^0.1.3",
|
||||
"ajv": "6.8.1",
|
||||
"amperize": "0.3.8",
|
||||
"analytics-node": "3.3.0",
|
||||
|
|
@ -113,7 +114,6 @@
|
|||
"simple-dom": "0.3.2",
|
||||
"simple-html-tokenizer": "0.5.7",
|
||||
"stripe": "^6.22.0",
|
||||
"unidecode": "0.1.8",
|
||||
"uuid": "3.3.2",
|
||||
"validator": "6.3.0",
|
||||
"xml": "1.0.1"
|
||||
|
|
|
|||
|
|
@ -200,6 +200,13 @@
|
|||
chalk "^2.4.1"
|
||||
sywac "^1.2.1"
|
||||
|
||||
"@tryghost/string@^0.1.3":
|
||||
version "0.1.3"
|
||||
resolved "https://registry.yarnpkg.com/@tryghost/string/-/string-0.1.3.tgz#aad595f40f984570aff042b08f407e67dc47f692"
|
||||
integrity sha512-JPVWEyI8NJEr1h/vlV0qL/Do05m45Tex+MGR5B6rvttl8XEUE3QwCFiG6mD7Yirjkja9h8EMjpgxiwWVCzKBPA==
|
||||
dependencies:
|
||||
unidecode "^0.1.8"
|
||||
|
||||
"@types/bluebird@^3.5.25":
|
||||
version "3.5.25"
|
||||
resolved "https://registry.yarnpkg.com/@types/bluebird/-/bluebird-3.5.25.tgz#59188b871208092e37767e4b3d80c3b3eaae43bd"
|
||||
|
|
@ -6890,7 +6897,7 @@ underscore@~1.8.3:
|
|||
version "1.8.3"
|
||||
resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.8.3.tgz#4f3fb53b106e6097fcf9cb4109f2a5e9bdfa5022"
|
||||
|
||||
unidecode@0.1.8:
|
||||
unidecode@^0.1.8:
|
||||
version "0.1.8"
|
||||
resolved "https://registry.yarnpkg.com/unidecode/-/unidecode-0.1.8.tgz#efbb301538bc45246a9ac8c559d72f015305053e"
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue