Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-02-03 23:00:14 -05:00
Code Issues Activity

🐛 Fixed outbound link tagger tagging non http urls (#16773)

Browse source 
refs https://github.com/TryGhost/Team/issues/3172

The outbound link tagger was tagging non http urls (i.e `javascript:`,
`mailto:`) which would prevent these urls from working as expected. This
change only allows urls to be tagged if they use the `http(s)` protocol.
This commit is contained in:
Michael Barrett 2023-05-15 09:19:33 +01:00 • committed by GitHub
parent 77dda7beba
commit 77d7b590bc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ghost/member-attribution/lib/OutboundLinkTagger.js
View file

@ -55,6 +55,11 @@ class OutboundLinkTagger {
return url; return url;
} }
// Check protocol
if (!url.protocol.startsWith('http')) {
return url;
}
// Check blocked domains // Check blocked domains
const referrerDomain = url.hostname; const referrerDomain = url.hostname;
if (blockedReferrerDomains.includes(referrerDomain)) { if (blockedReferrerDomains.includes(referrerDomain)) {

11
ghost/member-attribution/test/outbound-link-tagger.test.js
View file

@ -118,6 +118,17 @@ describe('OutboundLinkTagger', function () {
const updatedUrl = await service.addToUrl(url); const updatedUrl = await service.addToUrl(url);
should(updatedUrl.toString()).equal('https://example.com/?source=hello'); should(updatedUrl.toString()).equal('https://example.com/?source=hello');
}); });
it('does not add ref if the protocol is not http(s)', async function () {
const service = new OutboundLinkTagger({
getSiteUrl: () => 'https://blog.com',
isEnabled: () => true
});
const urlStr = 'javascript:alert("Hello, World!")';
const url = new URL(urlStr);
const updatedUrl = await service.addToUrl(url);
should(updatedUrl.toString()).equal(urlStr);
});
}); });
describe('addToHtml', function () { describe('addToHtml', function () {