jQuery plaintext to hyperlink issue

[Asudem]

Greetings all,

I am modifying some open source software to better suit my needs. This line right here in the software displays the time-stamp, username, and message of a currently chatting user. However, it appears that text is in plaintext and not an HTML element.

What I would like to do is something similar to this which converts plaintext links to actual hyperlinks. The messages sent through ajax, however, don't appear to be html elements/objects, so I can't just modify the HTML of the message.

Any advice on how I should modify the software to best suit my needs?

Any help would be greatly appreciated and thank you in advance!

[Deozaan]

Can't you run that regex code on the "text" variable from that highlighted line of code?

Specifically, use:

Code: Javascript [Select]

1. // Set the regex string
2. var regex = /(https?:\/\/([-\w\.]+)+(:\d+)?(\/([\w\/_\.]*(\?\S+)?)?)?)/ig
3. // Replace plain text links by hyperlinks
4. text = text.replace(regex, "<a href='$1' target='_blank'>$1</a>");

Between lines 154 and 155.

[Asudem]

Can't you run that regex code on the "text" variable from that highlighted line of code?

Specifically, use:

Code: Javascript [Select]

1. // Set the regex string
2. var regex = /(https?:\/\/([-\w\.]+)+(:\d+)?(\/([\w\/_\.]*(\?\S+)?)?)?)/ig
3. // Replace plain text links by hyperlinks
4. text = text.replace(regex, "<a href='$1' target='_blank'>$1</a>");

Between lines 154 and 155.

-Deozaan (June 10, 2016, 04:24 PM)

Sadly no, the results are literal:

<a href='http://www.google.com' target='_blank'>http://www.google.com</a>

[Deozaan]

Sounds like you need to find out where the code escapes the HTML characters and un-escape it.

[Asudem]

Sounds like you need to find out where the code escapes the HTML characters and un-escape it.

-Deozaan (June 10, 2016, 07:03 PM)

I am slightly new to javascript, but I think I have a fairly good basic grasp of reading it. I believe the escaping occurs somewhere here, not 100% how though...

[f0dder]

You'll probably want to hack in your handling in the cah.log.js - and you really, really, really want to be careful when dealing with user input.

The actual rendering of the text is this snippet:

Code: Javascript [Select]

1. if (opt_allow_html) {
2.     $(node[0]).html(full_msg);
3.   } else {
4.     $(node[0]).text(full_msg);
5.   }

So a quick guess without looking at the rest of the codebase is that the user input isn't escaped, it's simply not rendered as html content. You could add escape-then-linkify to the text codepath and replace .text() with .html(), while hoping that whatever escaping method you use handles all the nasty corner cases :-)

[Asudem]

You'll probably want to hack in your handling in the cah.log.js - and you really, really, really want to be careful when dealing with user input.

The actual rendering of the text is this snippet:

Code: Javascript [Select]

1. if (opt_allow_html) {
2.     $(node[0]).html(full_msg);
3.   } else {
4.     $(node[0]).text(full_msg);
5.   }

So a quick guess without looking at the rest of the codebase is that the user input isn't escaped, it's simply not rendered as html content. You could add escape-then-linkify to the text codepath and replace .text() with .html(), while hoping that whatever escaping method you use handles all the nasty corner cases :-)

-f0dder (June 11, 2016, 06:08 AM)

Super amazing find! Thank you so much! And yes, now the trick is the escape handling as the messages are in

[timestamp]<username> message

format and the angle brackets eat the usernames!

Again thank you for pointing me in the right direction everyone! 

[f0dder]

Super amazing find! Thank you so much! And yes, now the trick is the escape handling as the messages are in
Quote

    [timestamp]<username> message

format and the angle brackets eat the usernames!

-Asudem (June 11, 2016, 10:55 AM)

That's once concern - the biggest concern is security. You really don't want to execute random <script> blocks sent by malicious users

[Asudem]

Super amazing find! Thank you so much! And yes, now the trick is the escape handling as the messages are in
Quote

    [timestamp]<username> message

format and the angle brackets eat the usernames!

-Asudem (June 11, 2016, 10:55 AM)

That's once concern - the biggest concern is security. You really don't want to execute random <script> blocks sent by malicious users

-f0dder (June 11, 2016, 12:14 PM)

Oh no doubt that was my first though. Perhaps I'll just replace <script> tags altogether with null =P. I'm not too worried about my userbase at the moment and will brainstorm on some proper escape handling!

[f0dder]

Oh no doubt that was my first though. Perhaps I'll just replace <script> tags altogether with null =P. I'm not too worried about my userbase at the moment and will brainstorm on some proper escape handling!

-Asudem (June 11, 2016, 12:46 PM)

Yeah, and if people expect a standard server and have access to the standard code, they might not expect script attacks to work - and it's even less of an issue if you run a strictly private server.

Still, it's nice to Do Things Properly. And don't write your own escaping, find some existing project - there's insane corner cases, including all sorts of unicode nastyness.

[Asudem]

Okay, so, none of that worked. At all. We just started a live game and the changes made only applied to the user's own messages. So urls would turn into hyperlinks only if you posted them, but no one else would see it as a hyperlink. The change also took away usernames for everyone else but the user playing. 

[f0dder]

Sounds like you did the change before sending out the message, rather than immediality before displaying it? Also sounds like you're not doing proper escaping of the messages.

[Asudem]

Sounds like you did the change before sending out the message, rather than immediality before displaying it? Also sounds like you're not doing proper escaping of the messages.

-f0dder (June 13, 2016, 11:50 AM)

Not sure I'm following any of that at all.