Add regex to check for possible XSS attempts (#9400)

* Fix ruby linting issues

* Added test for uncovered branch

* Fixed typo

* Address PR comments

Co-authored-by: Brian Mayo <ioprotium@gmail.com>

app/labor/markdown_parser.rb

@@ -2,6 +2,11 @@ class MarkdownParser
   include ApplicationHelper
   include CloudinaryHelper
 
+  BAD_XSS_REGEX = [
+    /src=[\"'](data|&)/i,
+    %r{data:text/html[,;][\sa-z0-9]*}i,
+  ].freeze
+
   WORDS_READ_PER_MINUTE = 275.0
 
   def initialize(content, source: nil, user: nil)
@@ -142,10 +147,9 @@ class MarkdownParser
   end
 
   def catch_xss_attempts(markdown)
-    bad_xss = ['src="data', "src='data", "src='&", 'src="&', "data:text/html"]
-    bad_xss.each do |xss_attempt|
-      raise ArgumentError, "Invalid markdown detected" if markdown.include?(xss_attempt)
-    end
+    return unless markdown.match?(Regexp.union(BAD_XSS_REGEX))
+
+    raise ArgumentError, "Invalid markdown detected"
   end
 
   def allowed_image_host?(src)

spec/labor/markdown_parser_spec.rb

@@ -171,8 +171,22 @@ RSpec.describe MarkdownParser, type: :labor do
     expect(generate_and_parse_markdown(inline_code)).to include(inline_code[1..-2])
   end
 
-  it "raises an error if it detects a XSS attempt" do
-    expect { generate_and_parse_markdown("data:text/html") }.to raise_error(ArgumentError)
+  context "when checking XSS attempt in markdown content" do
+    it "raises an error if XSS attempt detected" do
+      expect {
+        generate_and_parse_markdown("src='DatA:text/html;base64:xxxx'")
+      }.to raise_error(ArgumentError)
+
+      expect {
+        generate_and_parse_markdown("src=\"&\"")
+      }.to raise_error(ArgumentError)
+    end
+
+    it "does not raise error if no XSS attempt detected" do
+       expect {
+        generate_and_parse_markdown("```const data = 'data:text/html';```")
+      }.not_to raise_error(ArgumentError)
+    end
   end
 
   context "when provided with an @username" do