Mailspring/spec-nylas
Evan Morikawa 06a1eb42b2 fix(iframe): catch relative and malformed uris
Summary:
Fixes T3252

When links were clicked with malformed, relative, or malicious href links
we'd perform default behavior instead of catching them.

If you have href="www.foo.bar" the browser by default thinks it's a
relative link. In our case it would prepend the full default base URI
which is file://path/to/edgehill. This would at best fail to do anything
and at worst execute an arbitrary file.

We now blacklist `file:` and check for the existence of a valid RFC 3986
schema on the URI.

Test Plan: manual

Reviewers: bengotow

Reviewed By: bengotow

Maniphest Tasks: T3252

Differential Revision: https://phab.nylas.com/D1888
2015-08-19 10:20:41 -07:00
..
components fix(iframe): catch relative and malformed uris 2015-08-19 10:20:41 -07:00
fixtures Threads now sorted by receivedrecetndate 2015-07-28 14:03:55 -07:00
models add more test coverage and refactor checking if a contact is the current user. fixes T3360. 2015-08-18 10:18:30 -07:00
stores feat(preferences): WIP Preferences panel 2015-08-14 15:40:11 -07:00
tasks fix(labels/folders): Temporarily disable changing nested messages 2015-08-05 17:39:48 -07:00
action-bridge-spec.coffee feat(logging): Developer bar, verbose logging to logstash, Electron 0.26.0 2015-05-19 17:02:46 -07:00
auto-update-manager-spec.coffee updater(*): Send current platform in update check, publish to S3 in /darwin/ folder 2015-06-30 11:03:24 -07:00
buffered-process-spec.coffee fix(tests): remove unnecessary failing test 2015-06-16 09:53:27 -07:00
clipboard-spec.coffee add(specs): +101 specs and 403 assertions from Atom 2015-06-02 19:51:00 -07:00
component-registry-spec.coffee feat(*): draft icon, misc fixes, and WorkspaceStore / custom toolbar in secondary windows 2015-06-03 16:02:19 -07:00
database-view-spec.coffee Threads now sorted by receivedrecetndate 2015-07-28 14:03:55 -07:00
dom-utils-spec.coffee fix(quoted-text): new system to remove quoted text 2015-07-21 11:34:47 -07:00
launch-services-spec.coffee feat(preferences): WIP Preferences panel 2015-08-14 15:40:11 -07:00
menu-manager-spec.coffee add(specs): +101 specs and 403 assertions from Atom 2015-06-02 19:51:00 -07:00
model-view-selection-spec.coffee fix(selection): Fix issue where selecting offscreen thread (null) could break selection 2015-06-01 18:29:39 -07:00
model-view-spec.coffee refactor(utils): switch to regular underscore 2015-05-19 16:06:59 -07:00
module-cache-spec.coffee add(specs): +101 specs and 403 assertions from Atom 2015-06-02 19:51:00 -07:00
nylas-protocol-handler-spec.coffee add(specs): +101 specs and 403 assertions from Atom 2015-06-02 19:51:00 -07:00
nylas-sync-worker-spec.coffee fix(sync-worker): Fix specs, add one testing backoff 2015-08-13 11:20:36 -07:00
package-manager-spec.coffee fix(test): remove bad nondeterministic package spec 2015-06-17 20:49:06 -07:00
package-spec.coffee add(specs): +101 specs and 403 assertions from Atom 2015-06-02 19:51:00 -07:00
quoted-html-parser-spec.coffee add a fix, TODO: refactor 2015-08-11 11:35:33 -07:00
quoted-plain-text-parser-spec.coffee feat(quoted-text): New quoted text engine 2015-07-08 09:51:33 -07:00
style-manager-spec.coffee add(specs): +101 specs and 403 assertions from Atom 2015-06-02 19:51:00 -07:00
styles-element-spec.coffee add(specs): +101 specs and 403 assertions from Atom 2015-06-02 19:51:00 -07:00
task-spec.coffee fix(build): Temporarily disable 'Task' tests Jenkins can't run, and avoid empty ui-variables files 2015-06-03 12:04:43 -07:00
test_utils.coffee fix(asar): Support ASAR, and running of specs in prod builds 2015-05-21 14:41:30 -07:00
theme-manager-spec.coffee fix(specs): silence noisy specs and fix warnings 2015-06-15 18:29:59 -07:00
undo-manager-spec.coffee fix(composer): polish composer edge cases 2015-05-19 16:12:39 -07:00
utils-spec.coffee Fixed bug where items in sent folder have "invalid date" 2015-07-31 08:23:03 -07:00