dandri/simplex-chat
1
0
Fork 0
mirror of https://github.com/simplex-chat/simplex-chat.git synced 2026-03-30 22:55:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

core: additional whitelisted query string parameters (not removed from URLs) (#6190)

Browse Source
This commit is contained in:
Evgeny
2025-08-16 16:46:34 +01:00
committed by GitHub
parent 2175db9345
commit 28a0959d96
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/Simplex/Chat/Markdown.hs
View File

@@ -350,7 +350,7 @@ sanitizeUri :: U.URI -> Maybe U.URI
sanitizeUri uri@U.URI {uriAuthority, uriPath, uriQuery = U.Query originalQS} =
let sanitizedQS
| isNamePath = case originalQS of
p : ps -> (if isBlacklisted (fst p) then id else (p :)) $ filter (isWhitelisted . fst) ps
p@(n, _) : ps -> (if isBlacklisted n && not (isWhitelisted n) then id else (p :)) $ filter (isWhitelisted . fst) ps
[] -> []
| otherwise = filter (isWhitelisted . fst) originalQS
in if length sanitizedQS == length originalQS
@@ -363,8 +363,17 @@ sanitizeUri uri@U.URI {uriAuthority, uriPath, uriQuery = U.Query originalQS} =
isNamePath = B.all (\c -> (c >= 'a' && c <= 'z') || c == '_' || c == '-' || c == '/') uriPath
qsWhitelist :: [(ByteString -> Bool, [ByteString])]
qsWhitelist =
[ (const True, ["q", "search"]),
(dom "youtube.com", ["v", "t"]),
[ (const True, ["q", "search", "search_query", "lang", "list", "page", "text", "type"]),
(dom "aliexpress.com", ["SearchText", "catId", "minPrice", "maxPrice"]),
(dom "amazon.com", ["i", "rh", "k"]), -- department, filter, keyword
(dom "baidu.com", ["wd"]), -- search string
(dom "bing.com", ["mkt"]), -- localized results
(dom "github.com", ["author", "diff", "w"]), -- author in search result, PR parameters
(dom "reddit.com", ["t"]), -- search type, time range
(dom "wikipedia.com", ["oldid", "uselang"]), -- to show old page revision and chosen user language
(dom "x.com", ["f"]), -- feed type
(dom "yahoo.com", ["p"]), -- search string
(dom "youtube.com", ["v", "t"]), -- video ID and timestamp
(dom "youtu.be", ["t"])
]
dom d h = d == h || (('.' `B.cons` d) `B.isSuffixOf` h)