Skip to content

Commit efe3802

Browse files
archmojarchmoj
authored
Merge pull request #5803 from plotly/dummy-anchor-href
Fix to improve sanitizing href inputs for SVG and HTML text elements
2 parents 17c9f0c + 75f6351 commit efe3802

29 files changed

+403
-204
lines changed

‎CHANGELOG.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,18 @@ To see all merged commits on the master branch that will be part of the next plo
99

1010
where X.Y.Z is the semver of most recent plotly.js release.
1111

12+
## [2.2.1] -- 2021-07-06
13+
14+
### Fixed
15+
- Fix to improve sanitizing href inputs for SVG and HTML text elements [[#5803](https://github.com/plotly/plotly.js/pull/5803)]
16+
17+
18+
## [1.58.5] -- 2021-07-06
19+
20+
### Fixed
21+
- Fix to improve sanitizing href inputs for SVG and HTML text elements [[#5803](https://github.com/plotly/plotly.js/pull/5803)]
22+
23+
1224
## [2.2.0] -- 2021-06-28
1325

1426
### Added

‎README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ You may also consider using [`plotly.js-dist`](https://www.npmjs.com/package/plo
5555
5656
```html
5757
<head>
58-
<script src="https://cdn.plot.ly/plotly-2.2.0.min.js"></script>
58+
<script src="https://cdn.plot.ly/plotly-2.2.1.min.js"></script>
5959
</head>
6060
<body>
6161
<div id="gd"></div>
@@ -72,7 +72,7 @@ You may also consider using [`plotly.js-dist`](https://www.npmjs.com/package/plo
7272
Alternatively you may consider using [native ES6 import](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules) in the script tag.
7373
```html
7474
<script type="module">
75-
import "https://cdn.plot.ly/plotly-2.2.0.min.js"
75+
import "https://cdn.plot.ly/plotly-2.2.1.min.js"
7676
Plotly.newPlot("gd", [{ y: [1, 2, 3] }])
7777
</script>
7878
```
@@ -82,10 +82,10 @@ Fastly supports Plotly.js with free CDN service. Read more at <https://www.fastl
8282
### Un-minified versions are also available on CDN
8383
While non-minified source files may contain characters outside UTF-8, it is recommended that you specify the `charset` when loading those bundles.
8484
```html
85-
<script src="https://cdn.plot.ly/plotly-2.2.0.js" charset="utf-8"></script>
85+
<script src="https://cdn.plot.ly/plotly-2.2.1.js" charset="utf-8"></script>
8686
```
8787

88-
> Please note that as of v2 the "plotly-latest" outputs (e.g. https://cdn.plot.ly/plotly-latest.min.js) will no longer be updated on the CDN, and will stay at the last v1 patch v1.58.4. Therefore, to use the CDN with plotly.js v2 and higher, you must specify an exact plotly.js version.
88+
> Please note that as of v2 the "plotly-latest" outputs (e.g. https://cdn.plot.ly/plotly-latest.min.js) will no longer be updated on the CDN, and will stay at the last v1 patch v1.58.5. Therefore, to use the CDN with plotly.js v2 and higher, you must specify an exact plotly.js version.
8989
9090
To support MathJax, you need to load version two of MathJax e.g. `v2.7.5` files from CDN or npm.
9191
```html

‎dist/README.md

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ The main plotly.js bundles weight in at:
4646
| 8 MB | 3.4 MB | 1019.6 kB | 8.3 MB |
4747

4848
#### CDN links
49-
> https://cdn.plot.ly/plotly-2.2.0.js
49+
> https://cdn.plot.ly/plotly-2.2.1.js
5050
51-
> https://cdn.plot.ly/plotly-2.2.0.min.js
51+
> https://cdn.plot.ly/plotly-2.2.1.min.js
5252
5353

5454
#### npm packages
@@ -94,9 +94,9 @@ The `basic` partial bundle contains trace modules `bar`, `pie` and `scatter`.
9494
| 2.7 MB | 1007.3 kB | 327.3 kB |
9595

9696
#### CDN links
97-
> https://cdn.plot.ly/plotly-basic-2.2.0.js
97+
> https://cdn.plot.ly/plotly-basic-2.2.1.js
9898
99-
> https://cdn.plot.ly/plotly-basic-2.2.0.min.js
99+
> https://cdn.plot.ly/plotly-basic-2.2.1.min.js
100100
101101

102102
#### npm packages
@@ -114,12 +114,12 @@ The `cartesian` partial bundle contains trace modules `bar`, `box`, `contour`, `
114114

115115
| Raw size | Minified size | Minified + gzip size |
116116
|------|-----------------|------------------------|
117-
| 3.3 MB | 1.2 MB | 398.7 kB |
117+
| 3.3 MB | 1.2 MB | 398.8 kB |
118118

119119
#### CDN links
120-
> https://cdn.plot.ly/plotly-cartesian-2.2.0.js
120+
> https://cdn.plot.ly/plotly-cartesian-2.2.1.js
121121
122-
> https://cdn.plot.ly/plotly-cartesian-2.2.0.min.js
122+
> https://cdn.plot.ly/plotly-cartesian-2.2.1.min.js
123123
124124

125125
#### npm packages
@@ -137,12 +137,12 @@ The `geo` partial bundle contains trace modules `choropleth`, `scatter` and `sca
137137

138138
| Raw size | Minified size | Minified + gzip size |
139139
|------|-----------------|------------------------|
140-
| 2.9 MB | 1 MB | 337.3 kB |
140+
| 2.9 MB | 1 MB | 337.4 kB |
141141

142142
#### CDN links
143-
> https://cdn.plot.ly/plotly-geo-2.2.0.js
143+
> https://cdn.plot.ly/plotly-geo-2.2.1.js
144144
145-
> https://cdn.plot.ly/plotly-geo-2.2.0.min.js
145+
> https://cdn.plot.ly/plotly-geo-2.2.1.min.js
146146
147147

148148
#### npm packages
@@ -163,9 +163,9 @@ The `gl3d` partial bundle contains trace modules `cone`, `isosurface`, `mesh3d`,
163163
| 3.8 MB | 1.5 MB | 482.7 kB |
164164

165165
#### CDN links
166-
> https://cdn.plot.ly/plotly-gl3d-2.2.0.js
166+
> https://cdn.plot.ly/plotly-gl3d-2.2.1.js
167167
168-
> https://cdn.plot.ly/plotly-gl3d-2.2.0.min.js
168+
> https://cdn.plot.ly/plotly-gl3d-2.2.1.min.js
169169
170170

171171
#### npm packages
@@ -183,12 +183,12 @@ The `gl2d` partial bundle contains trace modules `heatmapgl`, `parcoords`, `poin
183183

184184
| Raw size | Minified size | Minified + gzip size |
185185
|------|-----------------|------------------------|
186-
| 3.8 MB | 1.5 MB | 503.1 kB |
186+
| 3.8 MB | 1.5 MB | 503.2 kB |
187187

188188
#### CDN links
189-
> https://cdn.plot.ly/plotly-gl2d-2.2.0.js
189+
> https://cdn.plot.ly/plotly-gl2d-2.2.1.js
190190
191-
> https://cdn.plot.ly/plotly-gl2d-2.2.0.min.js
191+
> https://cdn.plot.ly/plotly-gl2d-2.2.1.min.js
192192
193193

194194
#### npm packages
@@ -209,9 +209,9 @@ The `mapbox` partial bundle contains trace modules `choroplethmapbox`, `densitym
209209
| 4.4 MB | 1.8 MB | 525 kB |
210210

211211
#### CDN links
212-
> https://cdn.plot.ly/plotly-mapbox-2.2.0.js
212+
> https://cdn.plot.ly/plotly-mapbox-2.2.1.js
213213
214-
> https://cdn.plot.ly/plotly-mapbox-2.2.0.min.js
214+
> https://cdn.plot.ly/plotly-mapbox-2.2.1.min.js
215215
216216

217217
#### npm packages
@@ -229,12 +229,12 @@ The `finance` partial bundle contains trace modules `bar`, `candlestick`, `funne
229229

230230
| Raw size | Minified size | Minified + gzip size |
231231
|------|-----------------|------------------------|
232-
| 3 MB | 1.1 MB | 353.5 kB |
232+
| 3 MB | 1.1 MB | 353.6 kB |
233233

234234
#### CDN links
235-
> https://cdn.plot.ly/plotly-finance-2.2.0.js
235+
> https://cdn.plot.ly/plotly-finance-2.2.1.js
236236
237-
> https://cdn.plot.ly/plotly-finance-2.2.0.min.js
237+
> https://cdn.plot.ly/plotly-finance-2.2.1.min.js
238238
239239

240240
#### npm packages
@@ -252,12 +252,12 @@ The `strict` partial bundle contains trace modules `bar`, `barpolar`, `box`, `ca
252252

253253
| Raw size | Minified size | Minified + gzip size |
254254
|------|-----------------|------------------------|
255-
| 6.7 MB | 2.8 MB | 840.4 kB |
255+
| 6.7 MB | 2.8 MB | 840.5 kB |
256256

257257
#### CDN links
258-
> https://cdn.plot.ly/plotly-strict-2.2.0.js
258+
> https://cdn.plot.ly/plotly-strict-2.2.1.js
259259
260-
> https://cdn.plot.ly/plotly-strict-2.2.0.min.js
260+
> https://cdn.plot.ly/plotly-strict-2.2.1.min.js
261261
262262

263263
#### npm packages

‎dist/plotly-basic.js

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* plotly.js (basic) v2.2.0
2+
* plotly.js (basic) v2.2.1
33
* Copyright 2012-2021, Plotly, Inc.
44
* All rights reserved.
55
* Licensed under the MIT license
@@ -49233,14 +49233,9 @@ function buildSVGText(containerNode, str) {
4923349233
var href = getQuotedMatch(extra, HREFMATCH);
4923449234

4923549235
if(href) {
49236-
// check safe protocols
49237-
var dummyAnchor = document.createElement('a');
49238-
dummyAnchor.href = href;
49239-
if(PROTOCOLS.indexOf(dummyAnchor.protocol) !== -1) {
49240-
// Decode href to allow both already encoded and not encoded
49241-
// URIs. Without decoding prior encoding, an already encoded
49242-
// URI would be encoded twice producing a semantically different URI.
49243-
nodeSpec.href = encodeURI(decodeURI(href));
49236+
var safeHref = sanitizeHref(href);
49237+
if(safeHref) {
49238+
nodeSpec.href = safeHref;
4924449239
nodeSpec.target = getQuotedMatch(extra, TARGETMATCH) || '_blank';
4924549240
nodeSpec.popup = getQuotedMatch(extra, POPUPMATCH);
4924649241
}
@@ -49255,6 +49250,27 @@ function buildSVGText(containerNode, str) {
4925549250
return hasLink;
4925649251
}
4925749252

49253+
function sanitizeHref(href) {
49254+
var decodedHref = encodeURI(decodeURI(href));
49255+
var dummyAnchor1 = document.createElement('a');
49256+
var dummyAnchor2 = document.createElement('a');
49257+
dummyAnchor1.href = href;
49258+
dummyAnchor2.href = decodedHref;
49259+
49260+
var p1 = dummyAnchor1.protocol;
49261+
var p2 = dummyAnchor2.protocol;
49262+
49263+
// check safe protocols
49264+
if(
49265+
PROTOCOLS.indexOf(p1) !== -1 &&
49266+
PROTOCOLS.indexOf(p2) !== -1
49267+
) {
49268+
return decodedHref;
49269+
} else {
49270+
return '';
49271+
}
49272+
}
49273+
4925849274
/*
4925949275
* sanitizeHTML: port of buildSVGText aimed at providing a clean subset of HTML
4926049276
* @param {string} str: the html string to clean
@@ -49289,10 +49305,9 @@ exports.sanitizeHTML = function sanitizeHTML(str) {
4928949305
var href = getQuotedMatch(extra, HREFMATCH);
4929049306

4929149307
if(href) {
49292-
var dummyAnchor = document.createElement('a');
49293-
dummyAnchor.href = href;
49294-
if(PROTOCOLS.indexOf(dummyAnchor.protocol) !== -1) {
49295-
nodeAttrs.href = encodeURI(decodeURI(href));
49308+
var safeHref = sanitizeHref(href);
49309+
if(safeHref) {
49310+
nodeAttrs.href = safeHref;
4929649311
var target = getQuotedMatch(extra, TARGETMATCH);
4929749312
if(target) {
4929849313
nodeAttrs.target = target;
@@ -84237,7 +84252,7 @@ function getSortFunc(opts, d2c) {
8423784252
'use strict';
8423884253

8423984254
// package version injected by `npm run preprocess`
84240-
exports.version = '2.2.0';
84255+
exports.version = '2.2.1';
8424184256

8424284257
},{}]},{},[8])(8)
8424384258
});

‎dist/plotly-basic.min.js

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/plotly-cartesian.js

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* plotly.js (cartesian) v2.2.0
2+
* plotly.js (cartesian) v2.2.1
33
* Copyright 2012-2021, Plotly, Inc.
44
* All rights reserved.
55
* Licensed under the MIT license
@@ -58392,14 +58392,9 @@ function buildSVGText(containerNode, str) {
5839258392
var href = getQuotedMatch(extra, HREFMATCH);
5839358393

5839458394
if(href) {
58395-
// check safe protocols
58396-
var dummyAnchor = document.createElement('a');
58397-
dummyAnchor.href = href;
58398-
if(PROTOCOLS.indexOf(dummyAnchor.protocol) !== -1) {
58399-
// Decode href to allow both already encoded and not encoded
58400-
// URIs. Without decoding prior encoding, an already encoded
58401-
// URI would be encoded twice producing a semantically different URI.
58402-
nodeSpec.href = encodeURI(decodeURI(href));
58395+
var safeHref = sanitizeHref(href);
58396+
if(safeHref) {
58397+
nodeSpec.href = safeHref;
5840358398
nodeSpec.target = getQuotedMatch(extra, TARGETMATCH) || '_blank';
5840458399
nodeSpec.popup = getQuotedMatch(extra, POPUPMATCH);
5840558400
}
@@ -58414,6 +58409,27 @@ function buildSVGText(containerNode, str) {
5841458409
return hasLink;
5841558410
}
5841658411

58412+
function sanitizeHref(href) {
58413+
var decodedHref = encodeURI(decodeURI(href));
58414+
var dummyAnchor1 = document.createElement('a');
58415+
var dummyAnchor2 = document.createElement('a');
58416+
dummyAnchor1.href = href;
58417+
dummyAnchor2.href = decodedHref;
58418+
58419+
var p1 = dummyAnchor1.protocol;
58420+
var p2 = dummyAnchor2.protocol;
58421+
58422+
// check safe protocols
58423+
if(
58424+
PROTOCOLS.indexOf(p1) !== -1 &&
58425+
PROTOCOLS.indexOf(p2) !== -1
58426+
) {
58427+
return decodedHref;
58428+
} else {
58429+
return '';
58430+
}
58431+
}
58432+
5841758433
/*
5841858434
* sanitizeHTML: port of buildSVGText aimed at providing a clean subset of HTML
5841958435
* @param {string} str: the html string to clean
@@ -58448,10 +58464,9 @@ exports.sanitizeHTML = function sanitizeHTML(str) {
5844858464
var href = getQuotedMatch(extra, HREFMATCH);
5844958465

5845058466
if(href) {
58451-
var dummyAnchor = document.createElement('a');
58452-
dummyAnchor.href = href;
58453-
if(PROTOCOLS.indexOf(dummyAnchor.protocol) !== -1) {
58454-
nodeAttrs.href = encodeURI(decodeURI(href));
58467+
var safeHref = sanitizeHref(href);
58468+
if(safeHref) {
58469+
nodeAttrs.href = safeHref;
5845558470
var target = getQuotedMatch(extra, TARGETMATCH);
5845658471
if(target) {
5845758472
nodeAttrs.target = target;
@@ -104098,7 +104113,7 @@ function getSortFunc(opts, d2c) {
104098104113
'use strict';
104099104114

104100104115
// package version injected by `npm run preprocess`
104101-
exports.version = '2.2.0';
104116+
exports.version = '2.2.1';
104102104117

104103104118
},{}]},{},[15])(15)
104104104119
});

‎dist/plotly-cartesian.min.js

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)