From ffe689ef72b7e5abd057cbdaadb3af06365e09ca Mon Sep 17 00:00:00 2001 From: hideheader Date: Wed, 18 Feb 2015 16:55:40 -0500 Subject: [PATCH] Sanitize `file:` URLs in "Find more styles" Remove the path from `file:` URLs in "Find more files" to avoid leaking users' file system structure to network. Userstyles will currently redirect to https://userstyles.org/styles/browse?search_terms=file%3A --- popup.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/popup.js b/popup.js index dd182e7a..51d5cea2 100644 --- a/popup.js +++ b/popup.js @@ -5,7 +5,7 @@ var writeStyleTemplate = document.createElement("a"); writeStyleTemplate.className = "write-style-link"; chrome.tabs.getSelected(null, function(tab) { - var urlWillWork = /^(file|http|https|chrome\-extension):.*/.test(tab.url); + var urlWillWork = /^(file|http|https|chrome\-extension):.*/.exec(tab.url); if (!urlWillWork) { ["installed", "find-styles", "write-style"].forEach(function(id) { @@ -16,7 +16,7 @@ chrome.tabs.getSelected(null, function(tab) { } chrome.extension.sendMessage({method: "getStyles", matchUrl: tab.url}, showStyles); - document.querySelector("#find-styles a").href = "https://userstyles.org/styles/browse/all/" + encodeURIComponent(tab.url); + document.querySelector("#find-styles a").href = "https://userstyles.org/styles/browse/all/" + encodeURIComponent("file" === urlWillWork[1] ? "file:" : tab.url); // Write new style links var writeStyleLinks = []