From f9f4115b7baeb9a73b63ecda3397994961071373 Mon Sep 17 00:00:00 2001 From: Vitaly Takmazov Date: Tue, 8 May 2018 21:46:36 +0300 Subject: common: strip login urls from input --- .../java/com/juick/server/CommandsManager.java | 5 +++-- .../src/main/java/com/juick/util/MessageUtils.java | 25 +++++++++++++++++++--- 2 files changed, 25 insertions(+), 5 deletions(-) (limited to 'juick-common/src') diff --git a/juick-common/src/main/java/com/juick/server/CommandsManager.java b/juick-common/src/main/java/com/juick/server/CommandsManager.java index 82d293fe..ab55bba7 100644 --- a/juick-common/src/main/java/com/juick/server/CommandsManager.java +++ b/juick-common/src/main/java/com/juick/server/CommandsManager.java @@ -29,9 +29,9 @@ import com.juick.server.helpers.CommandResult; import com.juick.server.helpers.TagStats; import com.juick.server.helpers.annotation.UserCommand; import com.juick.server.util.HttpUtils; -import com.juick.server.util.ImageUtils; import com.juick.server.util.TagUtils; import com.juick.service.*; +import com.juick.util.MessageUtils; import org.apache.commons.collections4.CollectionUtils; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.math.NumberUtils; @@ -79,7 +79,8 @@ public class CommandsManager { private ImagesService imagesService; public CommandResult processCommand(User user, String data, @Nonnull URI attachment) throws Exception { - String input = StringUtils.stripStart(data, null); + String strippedData = StringUtils.stripStart(data, null); + String input = MessageUtils.stripNonSafeUrls(strippedData); Optional cmd = MethodUtils.getMethodsListWithAnnotation(getClass(), UserCommand.class).stream() .filter(m -> Pattern.compile(m.getAnnotation(UserCommand.class).pattern(), m.getAnnotation(UserCommand.class).patternFlags()).matcher(input).matches()) diff --git a/juick-common/src/main/java/com/juick/util/MessageUtils.java b/juick-common/src/main/java/com/juick/util/MessageUtils.java index bb7edfc3..932577cb 100644 --- a/juick-common/src/main/java/com/juick/util/MessageUtils.java +++ b/juick-common/src/main/java/com/juick/util/MessageUtils.java @@ -22,8 +22,10 @@ import com.juick.Tag; import com.juick.User; import org.apache.commons.codec.CharEncoding; import org.apache.commons.lang3.StringUtils; +import org.springframework.web.util.UriComponentsBuilder; import java.io.UnsupportedEncodingException; +import java.net.URI; import java.net.URLEncoder; import java.util.ArrayList; import java.util.List; @@ -55,7 +57,10 @@ public class MessageUtils { return result; } - private static Pattern regexLinks2 = Pattern.compile("((?<=\\s)|(?<=\\A))([\\[\\{]|<)((?:ht|f)tps?://(?:www\\.)?([^\\/\\s\\\"\\)\\!]+)/?(?:[^\\]\\}](?http://juick.com/last?page=2 - msg = msg.replaceAll("((?<=\\s)|(?<=\\A))((?:ht|f)tps?://(?:www\\.)?([^\\/\\s\\n\\\"]+)/?[^\\s\\n\\\"]*)", "$1$2"); + msg = msg.replaceAll(regexUrl, "$1$2"); // (http://juick.com/last?page=2) // (http://juick.com/last?page=2) @@ -91,7 +96,7 @@ public class MessageUtils { // http://juick.com/last?page=2 // juick.com - msg = msg.replaceAll("((?<=\\s)|(?<=\\A))((?:ht|f)tps?://(?:www\\.)?([^\\/\\s\\n\\\"]+)/?[^\\s\\n\\\"]*)", "$1$3"); + msg = msg.replaceAll(regexUrl, "$1$3"); // [link text][http://juick.com/last?page=2] // link text @@ -268,4 +273,18 @@ public class MessageUtils { public static boolean isReply(Message message) { return message.getRid() > 0; } + + public static String stripNonSafeUrls(String input) { + // strip login urls + Matcher urlMatcher = Pattern.compile(MessageUtils.regexUrl).matcher(input); + while (urlMatcher.find()) { + URI uri = URI.create(urlMatcher.group(0)); + if (uri.getHost().equals("juick.com")) { + UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromUri(uri); + uriComponentsBuilder.replaceQueryParam("hash", StringUtils.EMPTY); + input = input.replace(urlMatcher.group(0), uriComponentsBuilder.build().toUriString()); + } + } + return input; + } } -- cgit v1.2.3