krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-16 14:17:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(string utils): do not escape possible regular expressions

Browse Source
This commit is contained in:
Matteo Pagliazzi
2020-04-28 16:47:52 +02:00
parent 2888f843e3
commit 61ca931e66
4 changed files with 16 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
test/api/unit/libs/stringUtils.test.js Normal file
View File

@@ -0,0 +1,12 @@
import { getMatchesByWordArray } from '../../../../website/server/libs/stringUtils';
import bannedWords from '../../../../website/server/libs/bannedWords';
describe('stringUtils', () => {
describe('getMatchesByWordArray', () => {
it('check all banned words are matched', async () => {
const message = bannedWords.join(',');
const matches = getMatchesByWordArray(message, bannedWords);
expect(matches.length).to.equal(bannedWords.length);
});
});
});

8
test/api/v3/integration/chat/POST-chat.test.js
View File

@@ -14,8 +14,6 @@ import {
TAVERN_ID, TAVERN_ID,
} from '../../../../../website/server/models/group'; } from '../../../../../website/server/models/group';
import { CHAT_FLAG_FROM_SHADOW_MUTE, MAX_MESSAGE_LENGTH } from '../../../../../website/common/script/constants'; import { CHAT_FLAG_FROM_SHADOW_MUTE, MAX_MESSAGE_LENGTH } from '../../../../../website/common/script/constants';
import { getMatchesByWordArray } from '../../../../../website/server/libs/stringUtils';
import bannedWords from '../../../../../website/server/libs/bannedWords';
import guildsAllowingBannedWords from '../../../../../website/server/libs/guildsAllowingBannedWords'; import guildsAllowingBannedWords from '../../../../../website/server/libs/guildsAllowingBannedWords';
import * as email from '../../../../../website/server/libs/email'; import * as email from '../../../../../website/server/libs/email';
@@ -292,12 +290,6 @@ describe('POST /chat', () => {
.that.includes(testBannedWords.join(', ')); .that.includes(testBannedWords.join(', '));
}); });
it('check all banned words are matched', async () => {
const message = bannedWords.join(',').replace(/\\/g, '');
const matches = getMatchesByWordArray(message, bannedWords);
expect(matches.length).to.equal(bannedWords.length);
});
it('does not error when bad word is suffix of a word', async () => { it('does not error when bad word is suffix of a word', async () => {
const wordAsSuffix = `prefix${testBannedWordMessage}`; const wordAsSuffix = `prefix${testBannedWordMessage}`;
const message = await user.post('/groups/habitrpg/chat', { message: wordAsSuffix }); const message = await user.post('/groups/habitrpg/chat', { message: wordAsSuffix });

9
website/server/libs/stringUtils.js
View File

@@ -1,15 +1,12 @@
import escapeRegExp from 'lodash/escapeRegExp';
export function removePunctuationFromString (str) { export function removePunctuationFromString (str) {
return str.replace(/[.,/#!@$%^&;:{}=\-_`~()]/g, ' '); return str.replace(/[.,/#!@$%^&;:{}=\-_`~()]/g, ' ');
} }
// NOTE: the wordsToMatch aren't escaped in order to support regular expressions,
// so this method should not be used if wordsToMatch contains unsanitized user input
export function getMatchesByWordArray (str, wordsToMatch) { export function getMatchesByWordArray (str, wordsToMatch) {
const matchedWords = []; const matchedWords = [];
const wordRegexs = wordsToMatch.map(word => { const wordRegexs = wordsToMatch.map(word => new RegExp(`\\b([^a-z]+)?${word}([^a-z]+)?\\b`, 'i'));
const escapedWord = escapeRegExp(word);
return new RegExp(`\\b([^a-z]+)?${escapedWord}([^a-z]+)?\\b`, 'i');
});
for (let i = 0; i < wordRegexs.length; i += 1) { for (let i = 0; i < wordRegexs.length; i += 1) {
const regEx = wordRegexs[i]; const regEx = wordRegexs[i];
const match = str.match(regEx); const match = str.match(regEx);

6
website/server/libs/user/validation.js
View File

@@ -1,12 +1,8 @@
import escapeRegExp from 'lodash/escapeRegExp';
import bannedSlurs from '../bannedSlurs'; import bannedSlurs from '../bannedSlurs';
import { getMatchesByWordArray } from '../stringUtils'; import { getMatchesByWordArray } from '../stringUtils';
import forbiddenUsernames from '../forbiddenUsernames'; import forbiddenUsernames from '../forbiddenUsernames';
const bannedSlurRegexs = bannedSlurs.map(word => { const bannedSlurRegexs = bannedSlurs.map(word => new RegExp(`.*${word}.*`, 'i'));
const escapedWord = escapeRegExp(word);
return new RegExp(`.*${escapedWord}.*`, 'i');
});
export function nameContainsSlur (username) { export function nameContainsSlur (username) {
for (let i = 0; i < bannedSlurRegexs.length; i += 1) { for (let i = 0; i < bannedSlurRegexs.length; i += 1) {