mirror of https://github.com/go-gitea/gitea
Add warning for BIDI characters in page renders and in diffs (#17562)
Fix #17514 Given the comments I've adjusted this somewhat. The numbers of characters detected are increased and include things like the use of U+300 to make à instead of à and non-breaking spaces. There is a button which can be used to escape the content to show it. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Gwyneth Morgan <gwymor@tilde.club> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>pull/18193/head^2
zeripath
3 years ago
committed by
GitHub
parent
ee60f27aec
commit
21ed4fd8da
@ -0,0 +1,230 @@ |
|||||||
|
// Copyright 2021 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package charset |
||||||
|
|
||||||
|
import ( |
||||||
|
"bytes" |
||||||
|
"fmt" |
||||||
|
"io" |
||||||
|
"strings" |
||||||
|
"unicode" |
||||||
|
"unicode/utf8" |
||||||
|
|
||||||
|
"golang.org/x/text/unicode/bidi" |
||||||
|
) |
||||||
|
|
||||||
|
// EscapeStatus represents the findings of the unicode escaper
|
||||||
|
type EscapeStatus struct { |
||||||
|
Escaped bool |
||||||
|
HasError bool |
||||||
|
HasBadRunes bool |
||||||
|
HasControls bool |
||||||
|
HasSpaces bool |
||||||
|
HasMarks bool |
||||||
|
HasBIDI bool |
||||||
|
BadBIDI bool |
||||||
|
HasRTLScript bool |
||||||
|
HasLTRScript bool |
||||||
|
} |
||||||
|
|
||||||
|
// Or combines two EscapeStatus structs into one representing the conjunction of the two
|
||||||
|
func (status EscapeStatus) Or(other EscapeStatus) EscapeStatus { |
||||||
|
st := status |
||||||
|
st.Escaped = st.Escaped || other.Escaped |
||||||
|
st.HasError = st.HasError || other.HasError |
||||||
|
st.HasBadRunes = st.HasBadRunes || other.HasBadRunes |
||||||
|
st.HasControls = st.HasControls || other.HasControls |
||||||
|
st.HasSpaces = st.HasSpaces || other.HasSpaces |
||||||
|
st.HasMarks = st.HasMarks || other.HasMarks |
||||||
|
st.HasBIDI = st.HasBIDI || other.HasBIDI |
||||||
|
st.BadBIDI = st.BadBIDI || other.BadBIDI |
||||||
|
st.HasRTLScript = st.HasRTLScript || other.HasRTLScript |
||||||
|
st.HasLTRScript = st.HasLTRScript || other.HasLTRScript |
||||||
|
return st |
||||||
|
} |
||||||
|
|
||||||
|
// EscapeControlString escapes the unicode control sequences in a provided string and returns the findings as an EscapeStatus and the escaped string
|
||||||
|
func EscapeControlString(text string) (EscapeStatus, string) { |
||||||
|
sb := &strings.Builder{} |
||||||
|
escaped, _ := EscapeControlReader(strings.NewReader(text), sb) |
||||||
|
return escaped, sb.String() |
||||||
|
} |
||||||
|
|
||||||
|
// EscapeControlBytes escapes the unicode control sequences a provided []byte and returns the findings as an EscapeStatus and the escaped []byte
|
||||||
|
func EscapeControlBytes(text []byte) (EscapeStatus, []byte) { |
||||||
|
buf := &bytes.Buffer{} |
||||||
|
escaped, _ := EscapeControlReader(bytes.NewReader(text), buf) |
||||||
|
return escaped, buf.Bytes() |
||||||
|
} |
||||||
|
|
||||||
|
// EscapeControlReader escapes the unicode control sequences a provided Reader writing the escaped output to the output and returns the findings as an EscapeStatus and an error
|
||||||
|
func EscapeControlReader(text io.Reader, output io.Writer) (escaped EscapeStatus, err error) { |
||||||
|
buf := make([]byte, 4096) |
||||||
|
readStart := 0 |
||||||
|
var n int |
||||||
|
var writePos int |
||||||
|
|
||||||
|
lineHasBIDI := false |
||||||
|
lineHasRTLScript := false |
||||||
|
lineHasLTRScript := false |
||||||
|
|
||||||
|
readingloop: |
||||||
|
for err == nil { |
||||||
|
n, err = text.Read(buf[readStart:]) |
||||||
|
bs := buf[:n+readStart] |
||||||
|
i := 0 |
||||||
|
|
||||||
|
for i < len(bs) { |
||||||
|
r, size := utf8.DecodeRune(bs[i:]) |
||||||
|
// Now handle the codepoints
|
||||||
|
switch { |
||||||
|
case r == utf8.RuneError: |
||||||
|
if writePos < i { |
||||||
|
if _, err = output.Write(bs[writePos:i]); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
writePos = i |
||||||
|
} |
||||||
|
// runes can be at most 4 bytes - so...
|
||||||
|
if len(bs)-i <= 3 { |
||||||
|
// if not request more data
|
||||||
|
copy(buf, bs[i:]) |
||||||
|
readStart = n - i |
||||||
|
writePos = 0 |
||||||
|
continue readingloop |
||||||
|
} |
||||||
|
// this is a real broken rune
|
||||||
|
escaped.HasBadRunes = true |
||||||
|
escaped.Escaped = true |
||||||
|
if err = writeBroken(output, bs[i:i+size]); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
writePos += size |
||||||
|
case r == '\n': |
||||||
|
if lineHasBIDI && !lineHasRTLScript && lineHasLTRScript { |
||||||
|
escaped.BadBIDI = true |
||||||
|
} |
||||||
|
lineHasBIDI = false |
||||||
|
lineHasRTLScript = false |
||||||
|
lineHasLTRScript = false |
||||||
|
|
||||||
|
case r == '\r' || r == '\t' || r == ' ': |
||||||
|
// These are acceptable control characters and space characters
|
||||||
|
case unicode.IsSpace(r): |
||||||
|
escaped.HasSpaces = true |
||||||
|
escaped.Escaped = true |
||||||
|
if writePos < i { |
||||||
|
if _, err = output.Write(bs[writePos:i]); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
} |
||||||
|
if err = writeEscaped(output, r); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
writePos = i + size |
||||||
|
case unicode.Is(unicode.Bidi_Control, r): |
||||||
|
escaped.Escaped = true |
||||||
|
escaped.HasBIDI = true |
||||||
|
if writePos < i { |
||||||
|
if _, err = output.Write(bs[writePos:i]); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
} |
||||||
|
lineHasBIDI = true |
||||||
|
if err = writeEscaped(output, r); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
writePos = i + size |
||||||
|
case unicode.Is(unicode.C, r): |
||||||
|
escaped.Escaped = true |
||||||
|
escaped.HasControls = true |
||||||
|
if writePos < i { |
||||||
|
if _, err = output.Write(bs[writePos:i]); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
} |
||||||
|
if err = writeEscaped(output, r); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
writePos = i + size |
||||||
|
case unicode.Is(unicode.M, r): |
||||||
|
escaped.Escaped = true |
||||||
|
escaped.HasMarks = true |
||||||
|
if writePos < i { |
||||||
|
if _, err = output.Write(bs[writePos:i]); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
} |
||||||
|
if err = writeEscaped(output, r); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
writePos = i + size |
||||||
|
default: |
||||||
|
p, _ := bidi.Lookup(bs[i : i+size]) |
||||||
|
c := p.Class() |
||||||
|
if c == bidi.R || c == bidi.AL { |
||||||
|
lineHasRTLScript = true |
||||||
|
escaped.HasRTLScript = true |
||||||
|
} else if c == bidi.L { |
||||||
|
lineHasLTRScript = true |
||||||
|
escaped.HasLTRScript = true |
||||||
|
} |
||||||
|
} |
||||||
|
i += size |
||||||
|
} |
||||||
|
if n > 0 { |
||||||
|
// we read something...
|
||||||
|
// write everything unwritten
|
||||||
|
if writePos < i { |
||||||
|
if _, err = output.Write(bs[writePos:i]); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// reset the starting positions for the next read
|
||||||
|
readStart = 0 |
||||||
|
writePos = 0 |
||||||
|
} |
||||||
|
} |
||||||
|
if readStart > 0 { |
||||||
|
// this means that there is an incomplete or broken rune at 0-readStart and we read nothing on the last go round
|
||||||
|
escaped.Escaped = true |
||||||
|
escaped.HasBadRunes = true |
||||||
|
if err = writeBroken(output, buf[:readStart]); err != nil { |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
} |
||||||
|
if err == io.EOF { |
||||||
|
if lineHasBIDI && !lineHasRTLScript && lineHasLTRScript { |
||||||
|
escaped.BadBIDI = true |
||||||
|
} |
||||||
|
err = nil |
||||||
|
return |
||||||
|
} |
||||||
|
escaped.HasError = true |
||||||
|
return |
||||||
|
} |
||||||
|
|
||||||
|
func writeBroken(output io.Writer, bs []byte) (err error) { |
||||||
|
_, err = fmt.Fprintf(output, `<span class="broken-code-point"><%X></span>`, bs) |
||||||
|
return |
||||||
|
} |
||||||
|
|
||||||
|
func writeEscaped(output io.Writer, r rune) (err error) { |
||||||
|
_, err = fmt.Fprintf(output, `<span class="escaped-code-point" data-escaped="[U+%04X]"><span class="char">%c</span></span>`, r, r) |
||||||
|
return |
||||||
|
} |
||||||
@ -0,0 +1,17 @@ |
|||||||
|
{{if .EscapeStatus.BadBIDI}} |
||||||
|
<div class="ui error message unicode-escape-prompt"> |
||||||
|
<span class="close icon hide-panel button" data-panel-closest=".message">{{svg "octicon-x" 16 "close inside"}}</span> |
||||||
|
<div class="header"> |
||||||
|
{{$.root.i18n.Tr "repo.bidi_bad_header"}} |
||||||
|
</div> |
||||||
|
<p>{{$.root.i18n.Tr "repo.bidi_bad_description" | Str2html}}</p> |
||||||
|
</div> |
||||||
|
{{else if .EscapeStatus.Escaped}} |
||||||
|
<div class="ui warning message unicode-escape-prompt"> |
||||||
|
<span class="close icon hide-panel button" data-panel-closest=".message">{{svg "octicon-x" 16 "close inside"}}</span> |
||||||
|
<div class="header"> |
||||||
|
{{$.root.i18n.Tr "repo.unicode_header"}} |
||||||
|
</div> |
||||||
|
<p>{{$.root.i18n.Tr "repo.unicode_description" | Str2html}}</p> |
||||||
|
</div> |
||||||
|
{{end}} |
||||||
@ -0,0 +1,28 @@ |
|||||||
|
export function initUnicodeEscapeButton() { |
||||||
|
$(document).on('click', 'a.escape-button', (e) => { |
||||||
|
e.preventDefault(); |
||||||
|
$(e.target).parents('.file-content, .non-diff-file-content').find('.file-code, .file-view').addClass('unicode-escaped'); |
||||||
|
$(e.target).hide(); |
||||||
|
$(e.target).siblings('a.unescape-button').show(); |
||||||
|
}); |
||||||
|
$(document).on('click', 'a.unescape-button', (e) => { |
||||||
|
e.preventDefault(); |
||||||
|
$(e.target).parents('.file-content, .non-diff-file-content').find('.file-code, .file-view').removeClass('unicode-escaped'); |
||||||
|
$(e.target).hide(); |
||||||
|
$(e.target).siblings('a.escape-button').show(); |
||||||
|
}); |
||||||
|
$(document).on('click', 'a.toggle-escape-button', (e) => { |
||||||
|
e.preventDefault(); |
||||||
|
const fileContent = $(e.target).parents('.file-content, .non-diff-file-content'); |
||||||
|
const fileView = fileContent.find('.file-code, .file-view'); |
||||||
|
if (fileView.hasClass('unicode-escaped')) { |
||||||
|
fileView.removeClass('unicode-escaped'); |
||||||
|
fileContent.find('a.unescape-button').hide(); |
||||||
|
fileContent.find('a.escape-button').show(); |
||||||
|
} else { |
||||||
|
fileView.addClass('unicode-escaped'); |
||||||
|
fileContent.find('a.unescape-button').show(); |
||||||
|
fileContent.find('a.escape-button').hide(); |
||||||
|
} |
||||||
|
}); |
||||||
|
} |
||||||
Loading…
Reference in new issue