mirrors/pdf.js
1
0
Fork 0
mirror of https://github.com/mozilla/pdf.js.git synced 2025-04-26 10:08:06 +02:00
Code Activity

Correctly validate URLs in XFA documents (bug 1731240)

Browse source 
With this patch we'll ensure that only valid absolute URLs can be used in XFA documents, similar to the existing validation done for "regular" PDF documents.
Furthermore, we'll also attempt to add a default protocol (i.e. `http`) to URLs beginning with "www." in XFA documents as well; this on its own is enough to fix https://bugzilla.mozilla.org/show_bug.cgi?id=1731240
This commit is contained in:
Jonas Jenwald 2021-09-20 14:36:43 +02:00
parent 580bfad628
commit 81a1c1cef7
4 changed files with 106 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/core/xfa/xhtml.js
View file

@ -29,8 +29,13 @@ import {
XmlObject,
} from "./xfa_object.js";
import { $buildXFAObject, NamespaceIds } from "./namespaces.js";
import {
addDefaultProtocolToUrl,
tryConvertUrlEncoding,
} from "../core_utils.js";
import { fixTextIndent, measureToString, setFontFamily } from "./html_utils.js";
import { getMeasurement, HTMLResult, stripQuotes } from "./utils.js";
import { createValidAbsoluteUrl } from "../../shared/util.js";
const XHTML_NS_ID = NamespaceIds.xhtml.id;
@ -321,7 +326,16 @@ class XhtmlObject extends XmlObject {
class A extends XhtmlObject {
constructor(attributes) {
super(attributes, "a");
this.href = attributes.href || "";
let href = "";
if (typeof attributes.href === "string") {
let url = addDefaultProtocolToUrl(attributes.href);
url = tryConvertUrlEncoding(url);
const absoluteUrl = createValidAbsoluteUrl(url);
if (absoluteUrl) {
href = absoluteUrl.href;
}
}
this.href = href;
}
}