Nofollow

precise_bbcode/bbcode/defaults/placeholder.py

@@ -3,9 +3,9 @@
 from django.core.exceptions import ValidationError
 from django.core.validators import URLValidator
 
+from precise_bbcode.conf import settings as bbcode_settings
 from precise_bbcode.bbcode.placeholder import BBCodePlaceholder
 
-
 __all__ = [
     'UrlBBCodePlaceholder',
     'EmailBBCodePlaceholder',
@@ -30,11 +30,17 @@ class UrlBBCodePlaceholder(BBCodePlaceholder):
     name = 'url'
 
     def validate(self, content, extra_context=None):
-        v = URLValidator()
-        try:
-            v(content)
-        except ValidationError:
+        for xss in bbcode_settings.URL_XSS_FILTER:
+            if xss in content:
+                return False
+        if content[:2] == '//':
             return False
+        if '://' in content:
+            v = URLValidator()
+            try:
+                v(content)
+            except ValidationError:
+                return False
         return True
 
 

precise_bbcode/bbcode/defaults/tag.py

@@ -104,27 +104,41 @@ class Options:
         replace_links = False
 
     def render(self, value, option=None, parent=None):
+        def bad_value_render(href):
+            if option:
+                return '[url={}]{}[/url]'.format(href, value)
+            else:
+                return '[url]{}[/url]'.format(value)
+
         href = option if option else value
         if href[0] == href[-1] and href[0] in ('"', '\'') and len(href) > 2:
             # URLs can be encapsulated in quotes (either single or double) that aren't part of the
             # URL. If that's the case, strip them out.
             href = href[1:-1]
+        if not href:
+            return bad_value_render(href)
         href = replace(href, bbcode_settings.BBCODE_ESCAPE_HTML)
-        if '://' not in href and self._domain_re.match(href):
-            href = 'http://' + href
-        v = URLValidator()
-
-        # Validates and renders the considered URL.
-        try:
-            v(href)
-        except ValidationError:
-            rendered = '[url={}]{}[/url]'.format(href, value) if option else \
-                '[url]{}[/url]'.format(value)
-        else:
-            content = value if option else href
-            rendered = '<a href="{}">{}</a>'.format(href, content or href)
+        for xss in bbcode_settings.URL_XSS_FILTER:
+            if xss in href:
+                return bad_value_render(href)
 
-        return rendered
+        if '://' not in href and self._domain_re.match(href):
+            href = 'https://' + href
+
+        if href[:2] == '//':
+            # Protocolless absolute URLs are unsafe.
+            return bad_value_render(href)
+
+        if '://' in href:
+            # Validates the considered URL only if it is not relative.
+            v = URLValidator()
+            try:
+                v(href)
+            except ValidationError:
+                return bad_value_render(href)
+
+        content = value if option else href
+        return '<a href="{}"{}>{}</a>'.format(href, bbcode_settings._BBCODE_NOFOLLOW, content or href)
 
 
 class ImgBBCodeTag(BBCodeTag):

precise_bbcode/bbcode/parser.py

@@ -1,6 +1,8 @@
 import re
 from collections import defaultdict
 
+from django.core.validators import URLValidator
+
 from precise_bbcode.bbcode.regexes import url_re
 from precise_bbcode.conf import settings as bbcode_settings
 from precise_bbcode.core.utils import replace
@@ -402,8 +404,19 @@ def _render_textual_content(self, data, replace_specialchars, replace_links, rep
         if replace_links:
             def linkrepl(match):
                 url = match.group(0)
-                href = url if '://' in url else 'http://' + url
-                return '<a href="{0}">{1}</a>'.format(href, url)
+                for xss in bbcode_settings.URL_XSS_FILTER:
+                    if xss in url:
+                        return url
+                if url[:2] == '//':
+                    return url
+                if '://' in url:
+                    v = URLValidator()
+                    try:
+                        v(url)
+                    except ValidationError:
+                        return url
+
+                return '<a href="{0}"{1}>{2}</a>'.format(url, bbcode_settings._BBCODE_NOFOLLOW, url)
             data = re.sub(url_re, linkrepl, data)
 
         if replace_smilies:

precise_bbcode/conf/settings.py

@@ -25,8 +25,12 @@
 
 # Other options
 BBCODE_NORMALIZE_NEWLINES = getattr(settings, 'BBCODE_NORMALIZE_NEWLINES', True)
+BBCODE_URL_NOFOLLOW = getattr(settings, 'BBCODE_URL_NOFOLLOW', False)
+_BBCODE_NOFOLLOW = getattr(settings, '_BBCODE_NOFOLLOW', ' rel="nofollow"' if BBCODE_URL_NOFOLLOW else '')
 
 
 # Smileys options
 BBCODE_ALLOW_SMILIES = getattr(settings, 'BBCODE_ALLOW_SMILIES', True)
 SMILIES_UPLOAD_TO = getattr(settings, 'BBCODE_SMILIES_UPLOAD_TO', 'precise_bbcode/smilies')
+
+URL_XSS_FILTER = '"<>^`{|}();'

tests/unit/test_parser.py

@@ -32,23 +32,25 @@ class TestParser(object):
             '[url]http://www.google.com[/url]',
             '<a href="http://www.google.com">http://www.google.com</a>'
         ),
-        ('[url=google.com]goto google[/url]', '<a href="http://google.com">goto google</a>'),
+        ('[url=google.com]goto google[/url]', '<a href="https://google.com">goto google</a>'),
         ('[url=http://google.com][/url]', '<a href="http://google.com">http://google.com</a>'),
         ('[url=\'http://google.com\'][/url]', '<a href="http://google.com">http://google.com</a>'),
         ('[url="http://google.com"][/url]', '<a href="http://google.com">http://google.com</a>'),
-        ('[URL=google.com]goto google[/URL]', '<a href="http://google.com">goto google</a>'),
+        ('[URL=google.com]goto google[/URL]', '<a href="https://google.com">goto google</a>'),
+        ('[URL=/localhost/www][/URL]', '<a href="/localhost/www">/localhost/www</a>'),
+        ('[URL=/localhost/www]goto localhost[/URL]', '<a href="/localhost/www">goto localhost</a>'),
         (
             '[url=<script>alert(1);</script>]xss[/url]',
             '[url=&lt;script&gt;alert(1);&lt;/script&gt;]xss[/url]'
         ),
         (
             'www.google.com foo.com/bar http://xyz.ci',
-            '<a href="http://www.google.com">www.google.com</a> '
-            '<a href="http://foo.com/bar">foo.com/bar</a> <a href="http://xyz.ci">http://xyz.ci</a>'
+            '<a href="www.google.com">www.google.com</a> '
+            '<a href="foo.com/bar">foo.com/bar</a> <a href="http://xyz.ci">http://xyz.ci</a>'
         ),
-        ('[url=relative/foo/bar.html]link[/url]', '[url=relative/foo/bar.html]link[/url]'),
-        ('[url=/absolute/foo/bar.html]link[/url]', '[url=/absolute/foo/bar.html]link[/url]'),
-        ('[url=./hello.html]world![/url]', '[url=./hello.html]world![/url]'),
+        ('[url=relative/foo/bar.html]link[/url]', '<a href="relative/foo/bar.html">link</a>'),
+        ('[url=/absolute/foo/bar.html]link[/url]', '<a href="/absolute/foo/bar.html">link</a>'),
+        ('[url=./hello.html]world![/url]', '<a href="./hello.html">world!</a>'),
         (
             '[url=javascript:alert(String.fromCharCode(88,83,83))]http://google.com[/url]',
             '[url=javascript:alert(String.fromCharCode(88,83,83))]http://google.com[/url]'
@@ -73,11 +75,19 @@ class TestParser(object):
             '[img]http://foo.com/fake.png [img] '
             'onerrorjavascript:alert(String.fromCharCode(88,83,83)) [/img] [/img]'
         ),
+        (
+            '[img]/localhost/www[/img]',
+            '<img src="/localhost/www" alt="" />'
+        ),
+        (
+            '[url=/localhost/www][img]/localhost/www[/img][/url]',
+            '<a href="/localhost/www"><img src="/localhost/www" alt="" /></a>'
+        ),
         ('[quote] \r\nhello\nworld! [/quote]', '<blockquote>hello<br />world!</blockquote>'),
         ('[code][b]hello world![/b][/code]', '<code>[b]hello world![/b]</code>'),
         (
             '[color=green]goto [url=google.com]google website[/url][/color]',
-            '<span style="color:green;">goto <a href="http://google.com">google website</a></span>'
+            '<span style="color:green;">goto <a href="https://google.com">google website</a></span>'
         ),
         ('[color=#FFFFFF]white[/color]', '<span style="color:#FFFFFF;">white</span>'),
         (
@@ -142,8 +152,8 @@ class TestParser(object):
                     'definition_string': '[youtube]{TEXT}[/youtube]',
                     'format_string': (
                         '<object width="425" height="350"><param name="movie" '
-                        'value="http://www.youtube.com/v/{TEXT}"></param><param name="wmode" '
-                        'value="transparent"></param><embed src="http://www.youtube.com/v/{TEXT}" '
+                        'value="https://www.youtube.com/v/{TEXT}"></param><param name="wmode" '
+                        'value="transparent"></param><embed src="https://www.youtube.com/v/{TEXT}" '
                         'type="application/x-shockwave-flash" wmode="transparent" width="425" '
                         'height="350"></embed></object>'
                     ),
@@ -208,7 +218,7 @@ class TestParser(object):
             ),
             (
                 '[youtube]ztD3mRMdqSw[/youtube]',
-                '<object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/ztD3mRMdqSw"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/ztD3mRMdqSw" type="application/x-shockwave-flash" wmode="transparent" width="425" height="350"></embed></object>'  # noqa
+                '<object width="425" height="350"><param name="movie" value="https://www.youtube.com/v/ztD3mRMdqSw"></param><param name="wmode" value="transparent"></param><embed src="https://www.youtube.com/v/ztD3mRMdqSw" type="application/x-shockwave-flash" wmode="transparent" width="425" height="350"></embed></object>'  # noqa
             ),
             (
                 '[h1=#FFF]hello world![/h1]',