mettags: limit the scope of url => metatag to http, https and / links.

- prevent of malicious injection of JS links and other unsafe types

rhodecode/lib/helpers.py

@@ -960,8 +960,8 b' tags_paterns = OrderedDict(('
     ('see', (re.compile(r'\[see\ \=\>\ *([a-zA-Z0-9\/\=\?\&\ \:\/\.\-]*)\]'),
             '<div class="metatag" tag="see">see: \\1 </div>')),
 
-    ('url', (re.compile(r'\[url\ \=\&gt;\ \[([a-zA-Z0-9\ \.\-\_]+)\]\((.*?)\)\]'),
-            '<div class="metatag" tag="url"> <a href="\\2">\\1</a> </div>')),
+    ('url', (re.compile(r'\[url\ \=\&gt;\ \[([a-zA-Z0-9\ \.\-\_]+)\]\((http://|https://|/)(.*?)\)\]'),
+            '<div class="metatag" tag="url"> <a href="\\2\\3">\\1</a> </div>')),
 
     ('license', (re.compile(r'\[license\ \=\&gt;\ *([a-zA-Z0-9\/\=\?\&amp;\ \:\/\.\-]*)\]'),
                 '<div class="metatag" tag="license"><a href="http:\/\/www.opensource.org/licenses/\\1">\\1</a></div>')),

rhodecode/tests/lib/test_libs.py

@@ -238,6 +238,19 b' def test_age_in_future(age_args, expecte'
      ]),
     # entry
     ((
+            "[url => [linkNameJS](javascript:alert(document.domain))]\n"
+            "[url => [linkNameHTTP](http://rhodecode.com)]\n"
+            "[url => [linkNameHTTPS](https://rhodecode.com)]\n"
+            "[url => [linkNamePath](/repo_group)]\n"
+     ),
+     [
+         ('generic', '[linkNameJS]'),
+         ('url', '[url => [linkNameHTTP](http://rhodecode.com)]'),
+         ('url', '[url => [linkNameHTTPS](https://rhodecode.com)]'),
+         ('url', '[url => [linkNamePath](/repo_group)]'),
+     ]),
+    # entry
+    ((
         "hello pta[tag] gog [[]] [[] sda ero[or]d [me =&gt;>< sa]"
         "[requires] [stale] [see<>=&gt;] [see =&gt; http://url.com]"
         "[requires =&gt; url] [lang =&gt; python] [just a tag] "