From bf8d44ca2b46c5cc994d0398ecf757b621009551 Mon Sep 17 00:00:00 2001 From: Ferdinand Thiessen Date: Wed, 5 Feb 2025 23:48:15 +0100 Subject: [PATCH] fix(settings): Also sanitize fediverse and twitter handle in the frontend Signed-off-by: Ferdinand Thiessen --- .../PersonalInfo/FediverseSection.vue | 46 +++++++++++-------- .../PersonalInfo/TwitterSection.vue | 35 +++++++------- ...nstants.js => AccountPropertyConstants.ts} | 31 ++++++++----- .../src/service/PersonalInfo/EmailService.js | 2 +- .../PersonalInfo/PersonalInfoService.js | 2 +- apps/settings/src/utils/validate.js | 2 +- cypress/e2e/settings/personal-info.cy.ts | 19 +++++--- 7 files changed, 82 insertions(+), 55 deletions(-) rename apps/settings/src/constants/{AccountPropertyConstants.js => AccountPropertyConstants.ts} (95%) diff --git a/apps/settings/src/components/PersonalInfo/FediverseSection.vue b/apps/settings/src/components/PersonalInfo/FediverseSection.vue index 3975308d58762..aa559b6b9a87d 100644 --- a/apps/settings/src/components/PersonalInfo/FediverseSection.vue +++ b/apps/settings/src/components/PersonalInfo/FediverseSection.vue @@ -21,30 +21,40 @@ --> - diff --git a/apps/settings/src/components/PersonalInfo/TwitterSection.vue b/apps/settings/src/components/PersonalInfo/TwitterSection.vue index dda773a01792b..8730cb36d7a68 100644 --- a/apps/settings/src/components/PersonalInfo/TwitterSection.vue +++ b/apps/settings/src/components/PersonalInfo/TwitterSection.vue @@ -21,30 +21,31 @@ --> - diff --git a/apps/settings/src/constants/AccountPropertyConstants.js b/apps/settings/src/constants/AccountPropertyConstants.ts similarity index 95% rename from apps/settings/src/constants/AccountPropertyConstants.js rename to apps/settings/src/constants/AccountPropertyConstants.ts index 2dcb6c98f9c7b..e9d892235fad2 100644 --- a/apps/settings/src/constants/AccountPropertyConstants.js +++ b/apps/settings/src/constants/AccountPropertyConstants.ts @@ -121,12 +121,12 @@ export const ACCOUNT_SETTING_PROPERTY_READABLE_ENUM = Object.freeze({ }) /** Enum of scopes */ -export const SCOPE_ENUM = Object.freeze({ - PRIVATE: 'v2-private', - LOCAL: 'v2-local', - FEDERATED: 'v2-federated', - PUBLISHED: 'v2-published', -}) +export enum SCOPE_ENUM { + PRIVATE = 'v2-private', + LOCAL = 'v2-local', + FEDERATED = 'v2-federated', + PUBLISHED = 'v2-published', +} /** Enum of readable account properties to supported scopes */ export const PROPERTY_READABLE_SUPPORTED_SCOPES_ENUM = Object.freeze({ @@ -197,11 +197,11 @@ export const SCOPE_PROPERTY_ENUM = Object.freeze({ export const DEFAULT_ADDITIONAL_EMAIL_SCOPE = SCOPE_ENUM.LOCAL /** Enum of verification constants, according to IAccountManager */ -export const VERIFICATION_ENUM = Object.freeze({ - NOT_VERIFIED: 0, - VERIFICATION_IN_PROGRESS: 1, - VERIFIED: 2, -}) +export enum VERIFICATION_ENUM { + NOT_VERIFIED = 0, + VERIFICATION_IN_PROGRESS = 1, + VERIFIED = 2, +} /** * Email validation regex @@ -210,3 +210,12 @@ export const VERIFICATION_ENUM = Object.freeze({ */ // eslint-disable-next-line no-control-regex export const VALIDATE_EMAIL_REGEX = /^(?!(?:(?:\x22?\x5C[\x00-\x7E]\x22?)|(?:\x22?[^\x5C\x22]\x22?)){255,})(?!(?:(?:\x22?\x5C[\x00-\x7E]\x22?)|(?:\x22?[^\x5C\x22]\x22?)){65,}@)(?:(?:[\x21\x23-\x27\x2A\x2B\x2D\x2F-\x39\x3D\x3F\x5E-\x7E]+)|(?:\x22(?:[\x01-\x08\x0B\x0C\x0E-\x1F\x21\x23-\x5B\x5D-\x7F]|(?:\x5C[\x00-\x7F]))*\x22))(?:\.(?:(?:[\x21\x23-\x27\x2A\x2B\x2D\x2F-\x39\x3D\x3F\x5E-\x7E]+)|(?:\x22(?:[\x01-\x08\x0B\x0C\x0E-\x1F\x21\x23-\x5B\x5D-\x7F]|(?:\x5C[\x00-\x7F]))*\x22)))*@(?:(?:(?!.*[^.]{64,})(?:(?:(?:xn--)?[a-z0-9]+(?:-+[a-z0-9]+)*\.){1,126}){1,}(?:(?:[a-z][a-z0-9]*)|(?:(?:xn--)[a-z0-9]+))(?:-+[a-z0-9]+)*)|(?:\[(?:(?:IPv6:(?:(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){7})|(?:(?!(?:.*[a-f0-9][:\]]){7,})(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){0,5})?::(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){0,5})?)))|(?:(?:IPv6:(?:(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){5}:)|(?:(?!(?:.*[a-f0-9]:){5,})(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){0,3})?::(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){0,3}:)?)))?(?:(?:25[0-5])|(?:2[0-4][0-9])|(?:1[0-9]{2})|(?:[1-9]?[0-9]))(?:\.(?:(?:25[0-5])|(?:2[0-4][0-9])|(?:1[0-9]{2})|(?:[1-9]?[0-9]))){3}))\]))$/i + +export interface IAccountProperty { + name: string + value: string + scope: SCOPE_ENUM + verified: VERIFICATION_ENUM +} + +export type AccountProperties = Record<(typeof ACCOUNT_PROPERTY_ENUM)[keyof (typeof ACCOUNT_PROPERTY_ENUM)], IAccountProperty> diff --git a/apps/settings/src/service/PersonalInfo/EmailService.js b/apps/settings/src/service/PersonalInfo/EmailService.js index f8256f0bdc01f..eb957f645ff39 100644 --- a/apps/settings/src/service/PersonalInfo/EmailService.js +++ b/apps/settings/src/service/PersonalInfo/EmailService.js @@ -26,7 +26,7 @@ import { generateOcsUrl } from '@nextcloud/router' import { confirmPassword } from '@nextcloud/password-confirmation' import '@nextcloud/password-confirmation/dist/style.css' -import { ACCOUNT_PROPERTY_ENUM, SCOPE_SUFFIX } from '../../constants/AccountPropertyConstants.js' +import { ACCOUNT_PROPERTY_ENUM, SCOPE_SUFFIX } from '../../constants/AccountPropertyConstants.ts' /** * Save the primary email of the user diff --git a/apps/settings/src/service/PersonalInfo/PersonalInfoService.js b/apps/settings/src/service/PersonalInfo/PersonalInfoService.js index 2e386a98bece7..3946db365029b 100644 --- a/apps/settings/src/service/PersonalInfo/PersonalInfoService.js +++ b/apps/settings/src/service/PersonalInfo/PersonalInfoService.js @@ -26,7 +26,7 @@ import { generateOcsUrl } from '@nextcloud/router' import { confirmPassword } from '@nextcloud/password-confirmation' import '@nextcloud/password-confirmation/dist/style.css' -import { SCOPE_SUFFIX } from '../../constants/AccountPropertyConstants.js' +import { SCOPE_SUFFIX } from '../../constants/AccountPropertyConstants.ts' /** * Save the primary account property value for the user diff --git a/apps/settings/src/utils/validate.js b/apps/settings/src/utils/validate.js index 4ea95593fbcfd..af8babdee8532 100644 --- a/apps/settings/src/utils/validate.js +++ b/apps/settings/src/utils/validate.js @@ -26,7 +26,7 @@ * TODO add nice validation errors for Profile page settings modal */ -import { VALIDATE_EMAIL_REGEX } from '../constants/AccountPropertyConstants.js' +import { VALIDATE_EMAIL_REGEX } from '../constants/AccountPropertyConstants.ts' /** * Validate the email input diff --git a/cypress/e2e/settings/personal-info.cy.ts b/cypress/e2e/settings/personal-info.cy.ts index a7564d5125ea0..13f4f596aa47b 100644 --- a/cypress/e2e/settings/personal-info.cy.ts +++ b/cypress/e2e/settings/personal-info.cy.ts @@ -115,18 +115,26 @@ const checkSettingsVisibility = (property: string, defaultVisibility: Visibility }) */ } -const genericProperties = ['Location', 'X (formerly Twitter)', 'Fediverse'] +const genericProperties = [ + ['Location', 'Berlin'], + ['X (formerly Twitter)', 'nextclouders'], + ['Fediverse', 'nextcloud@mastodon.xyz'], +] const nonfederatedProperties = ['Organisation', 'Role', 'Headline', 'About'] describe('Settings: Change personal information', { testIsolation: true }, () => { before(() => { + // make sure the fediverse check does not do http requests + cy.runOccCommand('config:system:set has_internet_connection --value false') // ensure we can set locale and language cy.runOccCommand('config:system:delete force_language') cy.runOccCommand('config:system:delete force_locale') }) after(() => { + cy.runOccCommand('config:system:delete has_internet_connection') + cy.runOccCommand('config:system:set force_language --value en') cy.runOccCommand('config:system:set force_locale --value en_US') }) @@ -350,22 +358,21 @@ describe('Settings: Change personal information', { testIsolation: true }, () => }) // Check generic properties that allow any visibility and any value - genericProperties.forEach((property) => { + genericProperties.forEach(([property, value]) => { it(`Can set ${property} and change its visibility`, () => { - const uniqueValue = `${property.toUpperCase()} ${property.toLowerCase()}` cy.contains('label', property).scrollIntoView() - inputForLabel(property).type(uniqueValue) + inputForLabel(property).type(value) handlePasswordConfirmation(user.password) cy.wait('@submitSetting') cy.reload() - inputForLabel(property).should('have.value', uniqueValue) + inputForLabel(property).should('have.value', value) checkSettingsVisibility(property) // check it is visible on the profile cy.visit(`/u/${user.userId}`) - cy.contains(uniqueValue).should('be.visible') + cy.contains(value).should('be.visible') }) })