-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Sanitize links in citation #5564
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
16 commits
Select commit
Hold shift + click to select a range
998bf4d
Allow Markdown in citation
compulim 2d5012b
Expect console.warn
compulim cfa7b71
Add sanitize link
compulim 51d0907
Sanitize links in claim interpreter
compulim 9975e0e
Add forbid-elements
compulim 3be4ebc
Fix null
compulim 408e821
Allow cite: URL
compulim e980775
Fix inline citation
compulim 421ce5c
Add entry
compulim ac3f43b
Add removed
compulim f6e5db8
Update doc on source of truth
compulim 8b75fc3
Update entry
compulim 8be0df7
Add schema
compulim f2bb398
Add comment
compulim 56481ca
Use regular function
compulim c3ca2ba
Allow empty string
compulim File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
75 changes: 75 additions & 0 deletions
75
__tests__/html2/citation/claimInterpreter/dangerousLink.html
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| <!doctype html> | ||
| <html lang="en-US"> | ||
| <head> | ||
| <link href="/assets/index.css" rel="stylesheet" type="text/css" /> | ||
| <script crossorigin="anonymous" src="/test-harness.js"></script> | ||
| <script crossorigin="anonymous" src="/test-page-object.js"></script> | ||
| <script crossorigin="anonymous" src="/__dist__/webchat-es5.js"></script> | ||
| </head> | ||
| <body> | ||
| <main id="webchat"></main> | ||
| <script> | ||
| run(async function () { | ||
| const { directLine, store } = testHelpers.createDirectLineEmulator(); | ||
|
|
||
| WebChat.renderWebChat( | ||
| { | ||
| directLine, | ||
| store | ||
| }, | ||
| document.getElementById('webchat') | ||
| ); | ||
|
|
||
| await pageConditions.uiConnected(); | ||
|
|
||
| await directLine.emulateIncomingActivity({ | ||
| entities: [ | ||
| { | ||
| '@context': 'https://schema.org', | ||
| '@id': '', | ||
| '@type': 'Message', | ||
| type: 'https://schema.org/Message', | ||
| citation: [ | ||
| { | ||
| '@id': ':_doesnt-care-1', | ||
| '@type': 'Claim', | ||
| appearance: { | ||
| '@type': 'DigitalDocument', | ||
| encodingFormat: 'application/octet-stream', | ||
| url: 'https://aka.ms/claim' | ||
| }, | ||
| claimInterpreter: { | ||
| '@type': 'Project', | ||
| slogan: 'Surfaced with Azure OpenAI', | ||
| url: 'javascript:alert(1)' | ||
| }, | ||
| position: '1' | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| text: `Fugiat excepteur anim irure consectetur ex nisi eu deserunt officia tempor eu et excepteur.[1] | ||
|
|
||
| [1]: https://aka.ms/claim | ||
| `, | ||
| type: 'message' | ||
| }); | ||
|
|
||
| await host.snapshot('local'); | ||
|
|
||
| const markdownElement = pageElements.activities()[0].querySelector('.webchat__text-content__markdown'); | ||
| const markdownLinks = markdownElement.querySelectorAll('a'); | ||
|
|
||
| // The javascript: shouldn't be a link. | ||
| expect(markdownLinks).toHaveLength(1); | ||
|
|
||
| expect(markdownLinks[0].getAttribute('href')).toBe('https://aka.ms/claim'); | ||
|
|
||
| const claimInterpreterElement = pageElements.activities()[0].querySelector('.webchat__activity-status__originator'); | ||
|
|
||
| expect(claimInterpreterElement).toHaveProperty('tagName', 'SPAN'); | ||
| expect(claimInterpreterElement).toHaveProperty('textContent', 'Surfaced with Azure OpenAI'); | ||
| }); | ||
| </script> | ||
| </body> | ||
| </html> |
Binary file added
BIN
+21.1 KB
__tests__/html2/citation/claimInterpreter/dangerousLink.html.snap-1.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
98 changes: 98 additions & 0 deletions
98
__tests__/html2/citation/markdownPreferredOverEntities.html
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| <!doctype html> | ||
| <html lang="en-US"> | ||
| <head> | ||
| <link href="/assets/index.css" rel="stylesheet" type="text/css" /> | ||
| <script type="importmap"> | ||
| { | ||
| "imports": { | ||
| "jest-mock": "https://esm.sh/jest-mock", | ||
| "react": "https://esm.sh/react@18", | ||
| "react-dom": "https://esm.sh/react-dom@18", | ||
| "react-dom/": "https://esm.sh/react-dom@18/" | ||
| } | ||
| } | ||
| </script> | ||
| <script type="module"> | ||
| import React from 'react'; | ||
| window.React = React; | ||
| </script> | ||
| <script crossorigin="anonymous" src="/test-harness.js"></script> | ||
| <script crossorigin="anonymous" src="/test-page-object.js"></script> | ||
| <script crossorigin="anonymous" src="/__dist__/webchat-es5.js"></script> | ||
| </head> | ||
| <body> | ||
| <main id="webchat"></main> | ||
| <script type="module"> | ||
| import { fn, spyOn } from 'jest-mock'; | ||
|
|
||
| run(async function () { | ||
| const { directLine, store } = testHelpers.createDirectLineEmulator(); | ||
|
|
||
| WebChat.renderWebChat( | ||
| { | ||
| directLine, | ||
| store | ||
| }, | ||
| document.getElementById('webchat') | ||
| ); | ||
|
|
||
| await pageConditions.uiConnected(); | ||
|
|
||
| const consoleWarn = fn(console.log.bind(console)); | ||
|
|
||
| spyOn(console, 'warn').mockImplementationOnce(consoleWarn); | ||
|
|
||
| await directLine.emulateIncomingActivity({ | ||
| entities: [ | ||
| { | ||
| '@context': 'https://schema.org', | ||
| '@id': '', | ||
| '@type': 'Message', | ||
| type: 'https://schema.org/Message', | ||
| citation: [ | ||
| { | ||
| '@id': ':_doesnt-care-1', | ||
| '@type': 'Claim', | ||
| appearance: { | ||
| '@type': 'DigitalDocument', | ||
| encodingFormat: 'application/octet-stream', | ||
| url: 'https://aka.ms/bad-link' | ||
| }, | ||
| position: '1' | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| text: `Ea officia[1] elit laboris[2] reprehenderit laborum elit ipsum qui eiusmod. | ||
|
|
||
| [1]: https://aka.ms/correct-link | ||
| [2]: javascript:alert(1) | ||
| `, | ||
| type: 'message' | ||
| }); | ||
|
|
||
| expect(consoleWarn).toHaveBeenCalledTimes(1); | ||
| expect(consoleWarn.mock.calls[0][0]).toBe( | ||
| 'botframework-webchat: When "Message.citation[].url" is set in entities, it must match its corresponding URL in Markdown link reference definition' | ||
| ); | ||
|
|
||
| await host.snapshot('local'); | ||
|
|
||
| const markdownElement = pageElements.activities()[0].querySelector('.webchat__text-content__markdown'); | ||
| const markdownClickableLinks = markdownElement.querySelectorAll('a[href]'); | ||
|
|
||
| // The javascript: shouldn't be a link. | ||
| expect(markdownClickableLinks).toHaveLength(1); | ||
|
|
||
| expect(markdownClickableLinks[0].getAttribute('href')).toBe('https://aka.ms/correct-link'); | ||
|
|
||
| const linkDefinitionItems = pageElements.linkDefinitions()[0].querySelectorAll('[role="listitem"] > *'); | ||
|
|
||
| // THe javascript: link is gone in Markdown, should be ignored in citation as well. | ||
| expect(linkDefinitionItems).toHaveLength(1); | ||
|
|
||
| expect(linkDefinitionItems[0].getAttribute('href')).toBe('https://aka.ms/correct-link'); | ||
| }); | ||
| </script> | ||
| </body> | ||
| </html> |
Binary file added
BIN
+16.5 KB
__tests__/html2/citation/markdownPreferredOverEntities.html.snap-1.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.