# HG changeset patch
# User Marcin Kuzminski <marcin@rhodecode.com>
# Date 2017-11-20 11:44:07
# Node ID 053218852c65ec799699daf48a3c6612429261aa
# Parent  dc922ddbd7df61e0faf43bac87907b5523d49a85

mettags: limit the scope of url => metatag to http, https and / links.

- prevent of malicious injection of JS links and other unsafe types

diff --git a/rhodecode/lib/helpers.py b/rhodecode/lib/helpers.py
--- a/rhodecode/lib/helpers.py
+++ b/rhodecode/lib/helpers.py
@@ -960,8 +960,8 @@ tags_paterns = OrderedDict((
     ('see', (re.compile(r'\[see\ \=\&gt;\ *([a-zA-Z0-9\/\=\?\&amp;\ \:\/\.\-]*)\]'),
             '<div class="metatag" tag="see">see: \\1 </div>')),
 
-    ('url', (re.compile(r'\[url\ \=\&gt;\ \[([a-zA-Z0-9\ \.\-\_]+)\]\((.*?)\)\]'),
-            '<div class="metatag" tag="url"> <a href="\\2">\\1</a> </div>')),
+    ('url', (re.compile(r'\[url\ \=\&gt;\ \[([a-zA-Z0-9\ \.\-\_]+)\]\((http://|https://|/)(.*?)\)\]'),
+            '<div class="metatag" tag="url"> <a href="\\2\\3">\\1</a> </div>')),
 
     ('license', (re.compile(r'\[license\ \=\&gt;\ *([a-zA-Z0-9\/\=\?\&amp;\ \:\/\.\-]*)\]'),
                 '<div class="metatag" tag="license"><a href="http:\/\/www.opensource.org/licenses/\\1">\\1</a></div>')),
diff --git a/rhodecode/tests/lib/test_libs.py b/rhodecode/tests/lib/test_libs.py
--- a/rhodecode/tests/lib/test_libs.py
+++ b/rhodecode/tests/lib/test_libs.py
@@ -238,6 +238,19 @@ def test_age_in_future(age_args, expecte
      ]),
     # entry
     ((
+            "[url =&gt; [linkNameJS](javascript:alert(document.domain))]\n"
+            "[url =&gt; [linkNameHTTP](http://rhodecode.com)]\n"
+            "[url =&gt; [linkNameHTTPS](https://rhodecode.com)]\n"
+            "[url =&gt; [linkNamePath](/repo_group)]\n"
+     ),
+     [
+         ('generic', '[linkNameJS]'),
+         ('url', '[url =&gt; [linkNameHTTP](http://rhodecode.com)]'),
+         ('url', '[url =&gt; [linkNameHTTPS](https://rhodecode.com)]'),
+         ('url', '[url =&gt; [linkNamePath](/repo_group)]'),
+     ]),
+    # entry
+    ((
         "hello pta[tag] gog [[]] [[] sda ero[or]d [me =&gt;>< sa]"
         "[requires] [stale] [see<>=&gt;] [see =&gt; http://url.com]"
         "[requires =&gt; url] [lang =&gt; python] [just a tag] "