<?php namespace BookStack\Entities\Repos;
+use Activity;
use BookStack\Actions\TagRepo;
use BookStack\Actions\ViewService;
use BookStack\Auth\Permissions\PermissionService;
use BookStack\Exceptions\NotifyException;
use BookStack\Uploads\AttachmentService;
use DOMDocument;
+use DOMNode;
+use DOMXPath;
+use Illuminate\Contracts\Pagination\LengthAwarePaginator;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Http\Request;
use Illuminate\Support\Collection;
+use Throwable;
class EntityRepo
{
* @param integer $id
* @param bool $allowDrafts
* @param bool $ignorePermissions
- * @return \BookStack\Entities\Entity
+ * @return Entity
*/
public function getById($type, $id, $allowDrafts = false, $ignorePermissions = false)
{
* @param []int $ids
* @param bool $allowDrafts
* @param bool $ignorePermissions
- * @return \Illuminate\Database\Eloquent\Builder[]|\Illuminate\Database\Eloquent\Collection|Collection
+ * @return Builder[]|\Illuminate\Database\Eloquent\Collection|Collection
*/
public function getManyById($type, $ids, $allowDrafts = false, $ignorePermissions = false)
{
* @param string $type
* @param string $slug
* @param string|bool $bookSlug
- * @return \BookStack\Entities\Entity
+ * @return Entity
* @throws NotFoundException
*/
public function getBySlug($type, $slug, $bookSlug = false)
* @param string $sort
* @param string $order
* @param null|callable $queryAddition
- * @return \Illuminate\Contracts\Pagination\LengthAwarePaginator
+ * @return LengthAwarePaginator
*/
public function getAllPaginated($type, int $count = 10, string $sort = 'name', string $order = 'asc', $queryAddition = null)
{
/**
* Get the child items for a chapter sorted by priority but
* with draft items floated to the top.
- * @param \BookStack\Entities\Bookshelf $bookshelf
+ * @param Bookshelf $bookshelf
* @return \Illuminate\Database\Eloquent\Collection|static[]
*/
public function getBookshelfChildren(Bookshelf $bookshelf)
* Get all child objects of a book.
* Returns a sorted collection of Pages and Chapters.
* Loads the book slug onto child elements to prevent access database access for getting the slug.
- * @param \BookStack\Entities\Book $book
+ * @param Book $book
* @param bool $filterDrafts
* @param bool $renderPages
* @return mixed
/**
* Get the child items for a chapter sorted by priority but
* with draft items floated to the top.
- * @param \BookStack\Entities\Chapter $chapter
+ * @param Chapter $chapter
* @return \Illuminate\Database\Eloquent\Collection|static[]
*/
public function getChapterChildren(Chapter $chapter)
/**
* Get the next sequential priority for a new child element in the given book.
- * @param \BookStack\Entities\Book $book
+ * @param Book $book
* @return int
*/
public function getNewBookPriority(Book $book)
/**
* Get a new priority for a new page to be added to the given chapter.
- * @param \BookStack\Entities\Chapter $chapter
+ * @param Chapter $chapter
* @return int
*/
public function getNewChapterPriority(Chapter $chapter)
/**
* Updates entity restrictions from a request
* @param Request $request
- * @param \BookStack\Entities\Entity $entity
- * @throws \Throwable
+ * @param Entity $entity
+ * @throws Throwable
*/
public function updateEntityPermissionsFromRequest(Request $request, Entity $entity)
{
* @param string $type
* @param array $input
* @param bool|Book $book
- * @return \BookStack\Entities\Entity
+ * @return Entity
*/
public function createFromInput($type, $input = [], $book = false)
{
* Update entity details from request input.
* Used for books and chapters
* @param string $type
- * @param \BookStack\Entities\Entity $entityModel
+ * @param Entity $entityModel
* @param array $input
- * @return \BookStack\Entities\Entity
+ * @return Entity
*/
public function updateFromInput($type, Entity $entityModel, $input = [])
{
/**
* Sync the books assigned to a shelf from a comma-separated list
* of book IDs.
- * @param \BookStack\Entities\Bookshelf $shelf
+ * @param Bookshelf $shelf
* @param string $books
*/
public function updateShelfBooks(Bookshelf $shelf, string $books)
* @param integer $newBookId
* @param Entity $entity
* @param bool $rebuildPermissions
- * @return \BookStack\Entities\Entity
+ * @return Entity
*/
public function changeBook($type, $newBookId, Entity $entity, $rebuildPermissions = false)
{
*/
protected function escapeScripts(string $html) : string
{
- $scriptSearchRegex = '/<script.*?>.*?<\/script>/ms';
- $matches = [];
- preg_match_all($scriptSearchRegex, $html, $matches);
+ if ($html == '') {
+ return $html;
+ }
- foreach ($matches[0] as $match) {
- $html = str_replace($match, htmlentities($match), $html);
+ libxml_use_internal_errors(true);
+ $doc = new DOMDocument();
+ $doc->loadHTML(mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8'));
+ $xPath = new DOMXPath($doc);
+
+ // Remove standard script tags
+ $scriptElems = $xPath->query('//body//*//script');
+ foreach ($scriptElems as $scriptElem) {
+ $scriptElem->parentNode->removeChild($scriptElem);
}
+
+ // Remove 'on*' attributes
+ $onAttributes = $xPath->query('//body//*/@*[starts-with(name(), \'on\')]');
+ foreach ($onAttributes as $attr) {
+ /** @var \DOMAttr $attr*/
+ $attrName = $attr->nodeName;
+ $attr->parentNode->removeAttribute($attrName);
+ }
+
+ $html = '';
+ $topElems = $doc->documentElement->childNodes->item(0)->childNodes;
+ foreach ($topElems as $child) {
+ $html .= $doc->saveHTML($child);
+ }
+
return $html;
}
/**
* Destroy a bookshelf instance
- * @param \BookStack\Entities\Bookshelf $shelf
- * @throws \Throwable
+ * @param Bookshelf $shelf
+ * @throws Throwable
*/
public function destroyBookshelf(Bookshelf $shelf)
{
/**
* Destroy the provided book and all its child entities.
- * @param \BookStack\Entities\Book $book
+ * @param Book $book
* @throws NotifyException
- * @throws \Throwable
+ * @throws Throwable
*/
public function destroyBook(Book $book)
{
/**
* Destroy a chapter and its relations.
- * @param \BookStack\Entities\Chapter $chapter
- * @throws \Throwable
+ * @param Chapter $chapter
+ * @throws Throwable
*/
public function destroyChapter(Chapter $chapter)
{
* Destroy a given page along with its dependencies.
* @param Page $page
* @throws NotifyException
- * @throws \Throwable
+ * @throws Throwable
*/
public function destroyPage(Page $page)
{
/**
* Destroy or handle the common relations connected to an entity.
- * @param \BookStack\Entities\Entity $entity
- * @throws \Throwable
+ * @param Entity $entity
+ * @throws Throwable
*/
protected function destroyEntityCommonRelations(Entity $entity)
{
- \Activity::removeEntity($entity);
+ Activity::removeEntity($entity);
$entity->views()->delete();
$entity->permissions()->delete();
$entity->tags()->delete();
/**
* Copy the permissions of a bookshelf to all child books.
* Returns the number of books that had permissions updated.
- * @param \BookStack\Entities\Bookshelf $bookshelf
+ * @param Bookshelf $bookshelf
* @return int
- * @throws \Throwable
+ * @throws Throwable
*/
public function copyBookshelfPermissions(Bookshelf $bookshelf)
{
$pageResp->assertSee($content);
}
- public function test_page_content_scripts_escaped_by_default()
+ public function test_page_content_scripts_removed_by_default()
{
$this->asEditor();
$page = Page::first();
- $script = '<script>console.log("hello-test")</script>';
+ $script = 'abc123<script>console.log("hello-test")</script>abc123';
$page->html = "escape {$script}";
$page->save();
$pageView = $this->get($page->getUrl());
$pageView->assertDontSee($script);
- $pageView->assertSee(htmlentities($script));
+ $pageView->assertSee('abc123abc123');
+ }
+
+ public function test_page_inline_on_attributes_removed_by_default()
+ {
+ $this->asEditor();
+ $page = Page::first();
+ $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';
+ $page->html = "escape {$script}";
+ $page->save();
+
+ $pageView = $this->get($page->getUrl());
+ $pageView->assertDontSee($script);
+ $pageView->assertSee('<p>Hello</p>');
}
public function test_page_content_scripts_show_when_configured()
$this->asEditor();
$page = Page::first();
config()->push('app.allow_content_scripts', 'true');
- $script = '<script>console.log("hello-test")</script>';
+
+ $script = 'abc123<script>console.log("hello-test")</script>abc123';
$page->html = "no escape {$script}";
$page->save();
$pageView = $this->get($page->getUrl());
$pageView->assertSee($script);
- $pageView->assertDontSee(htmlentities($script));
+ $pageView->assertDontSee('abc123abc123');
+ }
+
+ public function test_page_inline_on_attributes_show_if_configured()
+ {
+ $this->asEditor();
+ $page = Page::first();
+ config()->push('app.allow_content_scripts', 'true');
+
+ $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';
+ $page->html = "escape {$script}";
+ $page->save();
+
+ $pageView = $this->get($page->getUrl());
+ $pageView->assertSee($script);
+ $pageView->assertDontSee('<p>Hello</p>');
}
public function test_duplicate_ids_does_not_break_page_render()
projects / bookstack / commitdiff