From 51ca07033c8dbb5ef8c1abb54315c0b4b4242cda Mon Sep 17 00:00:00 2001 From: Engincan VESKE <43685404+EngincanV@users.noreply.github.com> Date: Tue, 4 Apr 2023 10:52:29 +0300 Subject: [PATCH] Cms: Don't allow external URLs --- .../CmsKitWebUnifiedModule.cs | 5 ++ .../Pages/Index.cshtml | 2 +- .../CmsKit/Comments/CmsKitCommentOptions.cs | 6 +++ .../CmsKit/Localization/Resources/en.json | 3 +- .../Public/Comments/CreateCommentInput.cs | 2 + ...cs => CreateCommentWithParametersInput.cs} | 4 +- .../Public/Comments/UpdateCommentInput.cs | 2 + .../Comments/CommentPublicAppService.cs | 54 +++++++++++++++++-- .../CmsKitPublicWebAutoMapperProfile.cs | 2 +- .../CmsKitPublicCommentsController.cs | 4 +- .../Commenting/CommentingViewComponent.cs | 6 ++- .../Components/Commenting/Default.cshtml | 2 + .../Shared/Components/Commenting/default.js | 6 ++- 13 files changed, 85 insertions(+), 13 deletions(-) rename modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/{CreateCommentWithParameteresInput.cs => CreateCommentWithParametersInput.cs} (84%) diff --git a/modules/cms-kit/host/Volo.CmsKit.Web.Unified/CmsKitWebUnifiedModule.cs b/modules/cms-kit/host/Volo.CmsKit.Web.Unified/CmsKitWebUnifiedModule.cs index 763218edc4..429d6b010c 100644 --- a/modules/cms-kit/host/Volo.CmsKit.Web.Unified/CmsKitWebUnifiedModule.cs +++ b/modules/cms-kit/host/Volo.CmsKit.Web.Unified/CmsKitWebUnifiedModule.cs @@ -1,3 +1,4 @@ +using System.Collections.Generic; using System.IO; using Microsoft.AspNetCore.Builder; using Microsoft.Extensions.DependencyInjection; @@ -168,6 +169,10 @@ public class CmsKitWebUnifiedModule : AbpModule { options.EntityTypes.Add(new CommentEntityTypeDefinition("quote")); options.IsRecaptchaEnabled = true; + options.AllowedExternalUrls = new List + { + "https://abp.io/" + }; }); Configure(options => diff --git a/modules/cms-kit/host/Volo.CmsKit.Web.Unified/Pages/Index.cshtml b/modules/cms-kit/host/Volo.CmsKit.Web.Unified/Pages/Index.cshtml index 1b3f3ff94c..74e86b7c76 100644 --- a/modules/cms-kit/host/Volo.CmsKit.Web.Unified/Pages/Index.cshtml +++ b/modules/cms-kit/host/Volo.CmsKit.Web.Unified/Pages/Index.cshtml @@ -90,7 +90,7 @@ @if (GlobalFeatureManager.Instance.IsEnabled()) { - @await Component.InvokeAsync(typeof(CommentingViewComponent), new {entityType = "quote", entityId = "2"}) + @await Component.InvokeAsync(typeof(CommentingViewComponent), new {entityType = "quote", entityId = "2", allowExternalUrls = false}) } diff --git a/modules/cms-kit/src/Volo.CmsKit.Domain.Shared/Volo/CmsKit/Comments/CmsKitCommentOptions.cs b/modules/cms-kit/src/Volo.CmsKit.Domain.Shared/Volo/CmsKit/Comments/CmsKitCommentOptions.cs index 94d3b785ec..c163c8da85 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Domain.Shared/Volo/CmsKit/Comments/CmsKitCommentOptions.cs +++ b/modules/cms-kit/src/Volo.CmsKit.Domain.Shared/Volo/CmsKit/Comments/CmsKitCommentOptions.cs @@ -13,4 +13,10 @@ public class CmsKitCommentOptions /// Default: false /// public bool IsRecaptchaEnabled { get; set; } + + /// + /// Indicates the allowed external URLs, which can be included in a comment. + /// If it's not specified, all external URLs will be allowed. + /// + public List AllowedExternalUrls { get; set; } = new(); } diff --git a/modules/cms-kit/src/Volo.CmsKit.Domain.Shared/Volo/CmsKit/Localization/Resources/en.json b/modules/cms-kit/src/Volo.CmsKit.Domain.Shared/Volo/CmsKit/Localization/Resources/en.json index 9bb8dd275c..2f7d8ce13d 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Domain.Shared/Volo/CmsKit/Localization/Resources/en.json +++ b/modules/cms-kit/src/Volo.CmsKit.Domain.Shared/Volo/CmsKit/Localization/Resources/en.json @@ -216,6 +216,7 @@ "CaptchaCode": "Captcha code", "CommentTextRequired": "Comment is required", "CaptchaCodeErrorMessage" : "The answer you entered for the CAPTCHA was not correct. Please try again", - "CaptchaCodeMissingMessage": "The captcha code is missing!" + "CaptchaCodeMissingMessage": "The captcha code is missing!", + "UnAllowedExternalUrlMessage": "You included an unallowed external URL. Please try again without the external URL." } } \ No newline at end of file diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentInput.cs b/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentInput.cs index c0eae8650e..ef78636ea7 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentInput.cs +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentInput.cs @@ -17,4 +17,6 @@ public class CreateCommentInput public Guid? CaptchaToken { get; set; } public int CaptchaAnswer { get; set; } + + public bool AllowExternalUrls { get; set; } = true; } diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentWithParameteresInput.cs b/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentWithParametersInput.cs similarity index 84% rename from modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentWithParameteresInput.cs rename to modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentWithParametersInput.cs index 7e156ef375..d8f946d1a0 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentWithParameteresInput.cs +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/CreateCommentWithParametersInput.cs @@ -6,7 +6,7 @@ using Volo.CmsKit.Comments; namespace Volo.CmsKit.Public.Comments; [Serializable] -public class CreateCommentWithParameteresInput +public class CreateCommentWithParametersInput { [Required] [DynamicStringLength(typeof(CommentConsts), nameof(CommentConsts.MaxTextLength))] @@ -18,6 +18,8 @@ public class CreateCommentWithParameteresInput [Required] public string EntityId { get; set; } + public bool AllowExternalUrls { get; set; } = true; + public Guid? RepliedCommentId { get; set; } public Guid? CaptchaToken { get; set; } diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/UpdateCommentInput.cs b/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/UpdateCommentInput.cs index 7ec1279704..0992622603 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/UpdateCommentInput.cs +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Application.Contracts/Volo/CmsKit/Public/Comments/UpdateCommentInput.cs @@ -14,4 +14,6 @@ public class UpdateCommentInput : IHasConcurrencyStamp public string Text { get; set; } public string ConcurrencyStamp { get; set; } + + public bool AllowExternalUrls { get; set; } = true; } diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Application/Volo/CmsKit/Public/Comments/CommentPublicAppService.cs b/modules/cms-kit/src/Volo.CmsKit.Public.Application/Volo/CmsKit/Public/Comments/CommentPublicAppService.cs index 05857e5db9..3d84a0ecf6 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Application/Volo/CmsKit/Public/Comments/CommentPublicAppService.cs +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Application/Volo/CmsKit/Public/Comments/CommentPublicAppService.cs @@ -1,9 +1,11 @@ using System; using System.Collections.Generic; using System.Linq; -using System.Security; +using System.Text.RegularExpressions; using System.Threading.Tasks; using Microsoft.AspNetCore.Authorization; +using Microsoft.Extensions.Options; +using Volo.Abp; using Volo.Abp.Application.Dtos; using Volo.Abp.Authorization; using Volo.Abp.Data; @@ -23,24 +25,27 @@ namespace Volo.CmsKit.Public.Comments; [RequiresGlobalFeature(typeof(CommentsFeature))] public class CommentPublicAppService : CmsKitPublicAppServiceBase, ICommentPublicAppService { + protected string RegexMarkdownUrlPattern = @"\[[^\]]*\]\((?.*?)\)(?![^\x60]*\x60)"; + protected ICommentRepository CommentRepository { get; } protected ICmsUserLookupService CmsUserLookupService { get; } public IDistributedEventBus DistributedEventBus { get; } protected CommentManager CommentManager { get; } - protected IAuthorizationService AuthorizationService { get; } + + protected CmsKitCommentOptions CmsCommentOptions { get; } public CommentPublicAppService( ICommentRepository commentRepository, ICmsUserLookupService cmsUserLookupService, IDistributedEventBus distributedEventBus, CommentManager commentManager, - IAuthorizationService authorizationService) + IOptionsSnapshot cmsCommentOptions) { CommentRepository = commentRepository; CmsUserLookupService = cmsUserLookupService; DistributedEventBus = distributedEventBus; CommentManager = commentManager; - AuthorizationService = authorizationService; + CmsCommentOptions = cmsCommentOptions.Value; } public virtual async Task> GetListAsync(string entityType, string entityId) @@ -56,6 +61,8 @@ public class CommentPublicAppService : CmsKitPublicAppServiceBase, ICommentPubli [Authorize] public virtual async Task CreateAsync(string entityType, string entityId, CreateCommentInput input) { + CheckExternalUrls(input.AllowExternalUrls, input.Text); + var user = await CmsUserLookupService.GetByIdAsync(CurrentUser.GetId()); if (input.RepliedCommentId.HasValue) @@ -86,6 +93,8 @@ public class CommentPublicAppService : CmsKitPublicAppServiceBase, ICommentPubli [Authorize] public virtual async Task UpdateAsync(Guid id, UpdateCommentInput input) { + CheckExternalUrls(input.AllowExternalUrls, input.Text); + var comment = await CommentRepository.GetAsync(id); if (comment.CreatorId != CurrentUser.GetId()) @@ -148,4 +157,41 @@ public class CommentPublicAppService : CmsKitPublicAppServiceBase, ICommentPubli { return ObjectMapper.Map(comments.Single(c => c.Comment.Id == commentId).Author); } + + private void CheckExternalUrls(bool allowExternalUrls, string text) + { + if (allowExternalUrls || !CmsCommentOptions.AllowedExternalUrls.Any()) + { + return; + } + + var matches = Regex.Matches(text, RegexMarkdownUrlPattern, + RegexOptions.Compiled | RegexOptions.IgnoreCase); + + foreach (Match match in matches) + { + if (!match.Success || match.Groups.Count < 2) + { + continue; + } + + var url = match.Groups[1].Value; + if (!IsExternalUrl(url)) + { + continue; + } + + if (!CmsCommentOptions.AllowedExternalUrls.Contains(url.Replace("www.", "").RemovePostFix("/"), + StringComparer.InvariantCultureIgnoreCase)) + { + throw new UserFriendlyException(L["UnAllowedExternalUrlMessage"]); + } + } + } + + private static bool IsExternalUrl(string url) + { + return url.StartsWith("https", StringComparison.InvariantCultureIgnoreCase) || + url.StartsWith("http", StringComparison.InvariantCultureIgnoreCase); + } } diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Web/CmsKitPublicWebAutoMapperProfile.cs b/modules/cms-kit/src/Volo.CmsKit.Public.Web/CmsKitPublicWebAutoMapperProfile.cs index 3c44f6fa1c..744d5afbad 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Web/CmsKitPublicWebAutoMapperProfile.cs +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Web/CmsKitPublicWebAutoMapperProfile.cs @@ -8,6 +8,6 @@ public class CmsKitPublicWebAutoMapperProfile : Profile { public CmsKitPublicWebAutoMapperProfile() { - CreateMap(); + CreateMap(); } } diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Web/Controllers/CmsKitPublicCommentsController.cs b/modules/cms-kit/src/Volo.CmsKit.Public.Web/Controllers/CmsKitPublicCommentsController.cs index bb2487587b..e10a606826 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Web/Controllers/CmsKitPublicCommentsController.cs +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Web/Controllers/CmsKitPublicCommentsController.cs @@ -29,14 +29,14 @@ public class CmsKitPublicCommentsController : AbpController } [HttpPost] - public async Task ValidateAsync([FromBody] CreateCommentWithParameteresInput input) + public async Task ValidateAsync([FromBody] CreateCommentWithParametersInput input) { if (CmsKitCommentOptions.IsRecaptchaEnabled && input.CaptchaToken.HasValue) { SimpleMathsCaptchaGenerator.Validate(input.CaptchaToken.Value, input.CaptchaAnswer); } - var dto = ObjectMapper.Map (input); + var dto = ObjectMapper.Map (input); await CommentPublicAppService.CreateAsync(input.EntityType, input.EntityId, dto); } } diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/CommentingViewComponent.cs b/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/CommentingViewComponent.cs index 304cfec687..fd7949674b 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/CommentingViewComponent.cs +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/CommentingViewComponent.cs @@ -60,7 +60,8 @@ public class CommentingViewComponent : AbpViewComponent public virtual async Task InvokeAsync( string entityType, string entityId, - IEnumerable referralLinks = null) + IEnumerable referralLinks = null, + bool allowExternalUrls = true) { referralLinks ??= Enumerable.Empty(); var comments = (await CommentPublicAppService @@ -72,6 +73,7 @@ public class CommentingViewComponent : AbpViewComponent { EntityId = entityId, EntityType = entityType, + AllowExternalUrls = allowExternalUrls, ReferralLinks = referralLinks, LoginUrl = loginUrl, Comments = comments.OrderByDescending(i => i.CreationTime).ToList() @@ -121,6 +123,8 @@ public class CommentingViewComponent : AbpViewComponent public string EntityType { get; set; } public string EntityId { get; set; } + + public bool AllowExternalUrls { get; set; } public IEnumerable ReferralLinks { get; set; } diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/Default.cshtml b/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/Default.cshtml index 944a818d74..d5b9a064d0 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/Default.cshtml +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/Default.cshtml @@ -32,6 +32,7 @@ style="@(string.IsNullOrEmpty(repliedCommentId?.ToString() ?? "") ? "" : "display:none")">
+
@@ -120,6 +121,7 @@
+
diff --git a/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/default.js b/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/default.js index 20b7119344..1c49e110f3 100644 --- a/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/default.js +++ b/modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/default.js @@ -115,7 +115,8 @@ formAsObject.id, { text: formAsObject.commentText, - concurrencyStamp: formAsObject.commentConcurrencyStamp + concurrencyStamp: formAsObject.commentConcurrencyStamp, + allowExternalUrls: formAsObject.allowExternalUrls } ).then(function () { widgetManager.refresh($widget); @@ -151,7 +152,8 @@ repliedCommentId: formAsObject.repliedCommentId, text: formAsObject.commentText, captchaToken: formAsObject.captchaId, - captchaAnswer: formAsObject.input?.captcha + captchaAnswer: formAsObject.input?.captcha, + allowExternalUrls: formAsObject.allowExternalUrls }), success: function () { widgetManager.refresh($widget);