From dbe3e9ff145dafcf42fd3f0f775a010c5693aed6 Mon Sep 17 00:00:00 2001
From: pizza-day <115205133+pizza-day@users.noreply.github.com>
Date: Sat, 8 Oct 2022 21:58:54 -0700
Subject: [PATCH] Sanitize URLs

---
 src/bbcode/mod.rs       | 18 ++++++++++++++++--
 src/bbcode/tag/embed.rs |  8 ++++++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/src/bbcode/mod.rs b/src/bbcode/mod.rs
index a031d0b..8441b79 100644
--- a/src/bbcode/mod.rs
+++ b/src/bbcode/mod.rs
@@ -210,7 +210,21 @@ mod tests {
         use super::parse;
 
         assert_eq!("&lt;b&gt;Test&lt;/b&gt;", parse("<b>Test</b>"));
-        assert_eq!("[xxx&lt;iframe&gt;]Test[/xxx&lt;iframe&gt;]", parse("[xxx<iframe>]Test[/xxx<iframe>]"));
-        assert_eq!("[url=javascript:alert(String.fromCharCode(88,83,83))]https://zombo.com[/url]", parse("[url=javascript:alert(String.fromCharCode(88,83,83))]https://zombo.com[/url]"))
+        assert_eq!(
+            "[xxx&lt;iframe&gt;]Test[/xxx&lt;iframe&gt;]",
+            parse("[xxx<iframe>]Test[/xxx<iframe>]")
+        );
+        assert_eq!(
+            "[url=javascript:alert(String.fromCharCode(88,83,83))]https://zombo.com[/url]",
+            parse("[url=javascript:alert(String.fromCharCode(88,83,83))]https://zombo.com[/url]")
+        );
+
+        assert_eq!("<a class=\"bbCode tagUrl\" ref=\"nofollow\" href=\"http://exa&quot;mple.com/\">test</a>", parse("[url=http://exa\"mple.com]test[/url]"));
+        assert_eq!("<a class=\"bbCode tagUrl\" ref=\"nofollow\" href=\"http://exa&quot;mple.com/\">test</a>", parse("[url=http://exa%22mple.com]test[/url]"));
+        assert_eq!("<a class=\"bbCode tagUrl\" ref=\"nofollow\" href=\"http://exa&quot;mple.com/\">http://exa%22mple.com</a>", parse("[url]http://exa%22mple.com[/url]"));
+        assert_eq!(
+            "<img src=\"http://exa&quot;mple.com/\" />",
+            parse("[img]http://exa%22mple.com[/img]")
+        );
     }
 }
diff --git a/src/bbcode/tag/embed.rs b/src/bbcode/tag/embed.rs
index 3cbf0ae..f646302 100644
--- a/src/bbcode/tag/embed.rs
+++ b/src/bbcode/tag/embed.rs
@@ -13,7 +13,7 @@ impl super::Tag {
             match url.scheme() {
                 "http" | "https" => {
                     el.clear_contents();
-                    return format!("<img src=\"{}\" />", url.as_str());
+                    return format!("<img src=\"{}\" />", sanitize_url_for_attribute(&url));
                 }
                 _ => {}
             }
@@ -54,7 +54,7 @@ impl super::Tag {
         match url {
             Some(url) => format!(
                 "<a class=\"bbCode tagUrl\" ref=\"nofollow\" href=\"{}\">{}",
-                url.as_str(),
+                sanitize_url_for_attribute(&url),
                 contents
             ),
             // If we have no content, we are broken.
@@ -78,3 +78,7 @@ fn url_arg(input: &str) -> Option<Result<Url, &str>> {
         Err(_) => None,
     }
 }
+
+fn sanitize_url_for_attribute(url: &Url) -> String {
+    url.as_str().replace("\"", "&quot;")
+}