lint: ban all dangerous HTML tags

[fdroidserver.git] / fdroidserver / lint.py

diff --git a/fdroidserver/lint.py b/fdroidserver/lint.py
index 66b66245eb47a4fb539c9ef4fb0274e9164158e5..b0a5cad76f93f52fb33752519bd98602e5605cf9 100644 (file)
--- a/fdroidserver/lint.py
+++ b/fdroidserver/lint.py
@@ -60,13 +60,59 @@ def forbid_shortener(domain):
 
 
 http_url_shorteners = [
+    forbid_shortener('1url.com'),
+    forbid_shortener('adf.ly'),
+    forbid_shortener('bc.vc'),
+    forbid_shortener('bit.do'),
+    forbid_shortener('bit.ly'),
+    forbid_shortener('bitly.com'),
+    forbid_shortener('budurl.com'),
+    forbid_shortener('buzurl.com'),
+    forbid_shortener('cli.gs'),
+    forbid_shortener('cur.lv'),
+    forbid_shortener('cutt.us'),
+    forbid_shortener('db.tt'),
+    forbid_shortener('filoops.info'),
     forbid_shortener('goo.gl'),
-    forbid_shortener('t.co'),
-    forbid_shortener('ur1.ca'),
     forbid_shortener('is.gd'),
-    forbid_shortener('bit.ly'),
+    forbid_shortener('ity.im'),
+    forbid_shortener('j.mp'),
+    forbid_shortener('l.gg'),
+    forbid_shortener('lnkd.in'),
+    forbid_shortener('moourl.com'),
+    forbid_shortener('ow.ly'),
+    forbid_shortener('para.pt'),
+    forbid_shortener('po.st'),
+    forbid_shortener('q.gs'),
+    forbid_shortener('qr.ae'),
+    forbid_shortener('qr.net'),
+    forbid_shortener('rdlnk.com'),
+    forbid_shortener('scrnch.me'),
+    forbid_shortener('short.nr'),
+    forbid_shortener('sn.im'),
+    forbid_shortener('snipurl.com'),
+    forbid_shortener('su.pr'),
+    forbid_shortener('t.co'),
     forbid_shortener('tiny.cc'),
+    forbid_shortener('tinyarrows.com'),
     forbid_shortener('tinyurl.com'),
+    forbid_shortener('tr.im'),
+    forbid_shortener('tweez.me'),
+    forbid_shortener('twitthis.com'),
+    forbid_shortener('twurl.nl'),
+    forbid_shortener('tyn.ee'),
+    forbid_shortener('u.bb'),
+    forbid_shortener('u.to'),
+    forbid_shortener('ur1.ca'),
+    forbid_shortener('urlof.site'),
+    forbid_shortener('v.gd'),
+    forbid_shortener('vzturl.com'),
+    forbid_shortener('x.co'),
+    forbid_shortener('xrl.us'),
+    forbid_shortener('yourls.org'),
+    forbid_shortener('zip.net'),
+    forbid_shortener('✩.ws'),
+    forbid_shortener('➡.ws'),
 ]
 
 http_checks = https_enforcings + http_url_shorteners + [
@@ -89,6 +135,8 @@ regex_checks = {
     'Donate': http_checks + [
         (re.compile(r'.*flattr\.com'),
          _("Flattr donation methods belong in the FlattrID flag")),
+        (re.compile(r'.*liberapay\.com'),
+         _("Liberapay donation methods belong in the LiberapayID flag")),
     ],
     'Changelog': http_checks,
     'Author Name': [
@@ -109,17 +157,17 @@ regex_checks = {
         (re.compile(r'.*\s$'),
          _("Unnecessary trailing space")),
     ],
-    'Description': [
+    'Description': https_enforcings + http_url_shorteners + [
         (re.compile(r'\s*[*#][^ .]'),
          _("Invalid bulleted list")),
         (re.compile(r'^\s'),
          _("Unnecessary leading space")),
         (re.compile(r'.*\s$'),
          _("Unnecessary trailing space")),
-        (re.compile(r'.*([^[]|^)\[[^:[\]]+( |\]|$)'),
-         _("Invalid link - use [http://foo.bar Link title] or [http://foo.bar]")),
-        (re.compile(r'(^|.* )https?://[^ ]+'),
-         _("Unlinkified link - use [http://foo.bar Link title] or [http://foo.bar]")),
+        (re.compile(r'.*<(applet|base|body|button|embed|form|head|html|iframe|img|input|link|object|picture|script|source|style|svg|video).*', re.IGNORECASE),
+         _("Forbidden HTML tags")),
+        (re.compile(r'''.*\s+src=["']javascript:.*'''),
+         _("Javascript in HTML src attributes")),
     ],
 }
 
@@ -321,10 +369,13 @@ def check_builds(app):
                 yield _("Branch '{branch}' used as commit in build '{versionName}'")\
                     .format(branch=s, versionName=build.versionName)
             for srclib in build.srclibs:
-                ref = srclib.split('@')[1].split('/')[0]
-                if ref.startswith(s):
-                    yield _("Branch '{branch}' used as commit in srclib '{srclib}'")\
-                        .format(branch=s, srclib=srclib)
+                if '@' in srclib:
+                    ref = srclib.split('@')[1].split('/')[0]
+                    if ref.startswith(s):
+                        yield _("Branch '{branch}' used as commit in srclib '{srclib}'")\
+                            .format(branch=s, srclib=srclib)
+                else:
+                    yield _('srclibs missing name and/or @') + ' (srclibs: ' + srclib + ')'
         for key in build.keys():
             if key not in supported_flags:
                 yield _('%s is not an accepted build field') % key