diff --git a/server/app.js b/server/app.js index b419c5cea..8b3e4652b 100644 --- a/server/app.js +++ b/server/app.js @@ -14,6 +14,7 @@ const GoogleActions = require('./googleActions.js'); const serveCompressedStaticAssets = require('./static-assets.mv.js'); const sanitizeFilename = require('sanitize-filename'); const asyncHandler = require('express-async-handler'); +const templateFn = require('./../client/template.js'); const { DEFAULT_BREW } = require('./brewDefaults.js'); @@ -420,8 +421,16 @@ if(isLocalEnvironment){ }); } +//Send rendered page +app.use(asyncHandler(async (req, res, next)=>{ + if (!req.route) return res.redirect('/'); // Catch-all for invalid routes + + const page = await renderPage(req, res); + if(!page) return; + res.send(page); +})); + //Render the page -const templateFn = require('./../client/template.js'); const renderPage = async (req, res)=>{ // Create configuration object const configuration = { @@ -450,13 +459,6 @@ const renderPage = async (req, res)=>{ return page; }; -//Send rendered page -app.use(asyncHandler(async (req, res, next)=>{ - const page = await renderPage(req, res); - if(!page) return; - res.send(page); -})); - //v=====----- Error-Handling Middleware -----=====v// //Format Errors as plain objects so all fields will appear in the string sent const formatErrors = (key, value)=>{ diff --git a/shared/naturalcrit/markdown.js b/shared/naturalcrit/markdown.js index c5d99afcc..2ee99f72b 100644 --- a/shared/naturalcrit/markdown.js +++ b/shared/naturalcrit/markdown.js @@ -86,7 +86,7 @@ renderer.link = function (href, title, text) { if(href[0] == '#') { self = true; } - href = cleanUrl(this.options.sanitize, this.options.baseUrl, href); + href = cleanUrl(href); if(href === null) { return text; @@ -734,28 +734,14 @@ Marked.use(mustacheInjectBlock); Marked.use({ renderer: renderer, tokenizer: tokenizer, mangle: false }); Marked.use(MarkedExtendedTables(), MarkedGFMHeadingId(), MarkedSmartypantsLite(), MarkedEmojis(MarkedEmojiOptions)); -const nonWordAndColonTest = /[^\w:]/g; -const cleanUrl = function (sanitize, base, href) { - if(sanitize) { - let prot; - try { - prot = decodeURIComponent(unescape(href)) - .replace(nonWordAndColonTest, '') - .toLowerCase(); - } catch (e) { - return null; - } - if(prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0 || prot.indexOf('data:') === 0) { - return null; - } - } - try { - href = encodeURI(href).replace(/%25/g, '%'); - } catch (e) { - return null; - } - return href; -}; +function cleanUrl(href) { + try { + href = encodeURI(href).replace(/%25/g, '%'); + } catch { + return null; + } + return href; +} const escapeTest = /[&<>"']/; const escapeReplace = /[&<>"']/g;