Differential D10188 Diff 26252 dataengines/notifications/notificationsanitizer.cpp

Changeset View

Standalone View

dataengines/notifications/notificationsanitizer.cpp

This file was added.

1		/*
2		* Copyright (C) 2017 David Edmundson <davidedmundson@kde.org>
3		*
4		* This program is free software you can redistribute it and/or
5		* modify it under the terms of the GNU Library General Public
6		* License as published by the Free Software Foundation; either
7		* version 2 of the License, or (at your option) any later version.
8		*
9		* This program is distributed in the hope that it will be useful,
10		* but WITHOUT ANY WARRANTY; without even the implied warranty of
11		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12		* Library General Public License for more details.
13		*
14		* You should have received a copy of the GNU Library General Public License
15		* along with this library; see the file COPYING.LIB. If not, write to
16		* the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
17		* Boston, MA 02110-1301, USA.
18		*/
19
20		#include "notificationsanitizer.h"
21
22		#include <QXmlStreamReader>
23		#include <QXmlStreamWriter>
24		#include <QRegularExpression>
25		#include <QDebug>
26		#include <QUrl>
27
28		QString NotificationSanitizer::parse(const QString &text)
29		{
30		// replace all \ns with <br/>
31		QString t = text;
32
33		t.replace(QLatin1String("\n"), QStringLiteral("<br/>"));
34		// Now remove all inner whitespace (\ns are already <br/>s)
35		t = t.simplified();
	fvogtUnsubmitted Not Done Missing `)` fvogt: Missing `)`
36		// Finally, check if we don't have multiple <br/>s following,
37		// can happen for example when "\n \n" is sent, this replaces
38		// all <br/>s in succsession with just one
39		t.replace(QRegularExpression(QStringLiteral("<br/>\\s<br/>(\\s\|<br/>)")), QLatin1String("<br/>"));
40		// This fancy RegExp escapes every occurence of & since QtQuick Text will blatantly cut off
41		// text where it finds a stray ampersand.
42		// Only &{apos, quot, gt, lt, amp}; as well as &#123 character references will be allowed
43		t.replace(QRegularExpression(QStringLiteral("&(?!(?:apos\|quot\|[gl]t\|amp);\|#)")), QLatin1String("&"));
44
45		QXmlStreamReader r(QStringLiteral("<html>") + t + QStringLiteral("</html>"));
	broulikUnsubmitted Not Done We need a `QXmlStreamEntityResolver` like `KNotification` has otherwise HTML entities like `Ä` (for `Ä`) will error out. broulik: We need a `QXmlStreamEntityResolver` like `KNotification` has otherwise HTML entities like…
	davidedmundsonAuthorUnsubmitted Not Done They don't, because that's not what we're parsing. We will parse &Auml; which is handled Sending Ä will get Ä Sending Ä will show Ä Old code is the same. davidedmundson: They don't, because that's not what we're parsing. We will parse &Auml; which is handled…
	broulikUnsubmitted Not Done I see. Nevermind then. broulik: I see. Nevermind then.
46		QString result;
47		QXmlStreamWriter out(&result);
48
49		const QVector<QString> allowedTags = {"b", "i", "u", "img", "a", "html", "br"};
50
	aacidUnsubmitted Not Done make it const :D aacid: make it const :D
51		out.writeStartDocument();
52		while (!r.atEnd()) {
53		r.readNext();
54
55		if (r.tokenType() == QXmlStreamReader::StartElement) {
56		const QString name = r.name().toString();
57		if (!allowedTags.contains(name)) {
58		continue;
	fvogtUnsubmitted Not Done Invert this and `continue` instead? fvogt: Invert this and `continue` instead?
59		}
60		out.writeStartElement(name);
61		if (name == QLatin1String("img")) {
62		auto src = r.attributes().value("src").toString();
63		auto alt = r.attributes().value("alt").toString();
64
65		const QUrl url(src);
66		if (url.isLocalFile()) {
67		out.writeAttribute(QStringLiteral("src"), src);
68		} else {
69		//image denied for security reasons! Do not copy the image src here!
70		}
71
72		out.writeAttribute(QStringLiteral("alt"), alt);
	broulikUnsubmitted Not Done Don't write `alt` if it doesn't have one? broulik: Don't write `alt` if it doesn't have one?
	davidedmundsonAuthorUnsubmitted Not Done QmlStreamWriter skips it if the value is empty davidedmundson: QmlStreamWriter skips it if the value is empty
73		}
74		if (name == QLatin1String("a")) {
75		out.writeAttribute(QStringLiteral("href"), r.attributes().value("href").toString());
76		}
77		}
78
79		if (r.tokenType() == QXmlStreamReader::EndElement) {
80		const QString name = r.name().toString();
81		if (!allowedTags.contains(name)) {
82		continue;
83		}
84		out.writeEndElement();
85		}
86
87		if (r.tokenType() == QXmlStreamReader::Characters) {
88		const auto text = r.text().toString();
89		out.writeCharacters(text); //this auto escapes chars -> HTML entities
90		}
91		}
92		out.writeEndDocument();
93
94		if (r.hasError()) {
95		qWarning() << "Notification to send to backend contains invalid XML: "
96		<< r.errorString() << "line" << r.lineNumber()
97		<< "col" << r.columnNumber();
98		}
99
100		// The Text.StyledText format handles only html3.2 stuff and ' is html4 stuff
101		// so we need to replace it here otherwise it will not render at all.
102		result = result.replace(QLatin1String("'"), QChar('\''));
103
104
105		return result;
106		}