Revize 3c185841

HTML preprocessing and sanitization

Backend/Core/Core.csproj

@@ -10 +10 @@
     <PackageReference Include="AutoMapper" Version="11.0.1" />
     <PackageReference Include="AutoMapper.Extensions.Microsoft.DependencyInjection" Version="11.0.0" />
     <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
+    <PackageReference Include="HtmlAgilityPack" Version="1.11.42" />
+    <PackageReference Include="HtmlSanitizer" Version="7.1.488" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="6.0.3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="6.0.3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="6.0.3">

Backend/Core/Services/AnnotationService/AnnotationServiceEF.cs

@@ -11 +11 @@
 using Microsoft.EntityFrameworkCore;
 using AutoMapper;
 using Models.Tags;
+using Ganss.XSS;
+using HtmlAgilityPack;
+using System.Text.RegularExpressions;
 
 namespace Core.Services.AnnotationService
 {
@@ -98 +101 @@
                 .Include(a => a.User)
                 .Include(a => a.Document).ThenInclude(d => d.Content)
                 .First();
-            
+
             if (userRole < ERole.ADMINISTRATOR)
             {
                 if (annotation.User.Id != userId)
@@ -108 +111 @@
             }
 
             var documentContent = context.Documents.Where(d => d.Id == annotation.Document.Id).Select(d => d.Content).First();
+            var preprocessingResult = PreprocessHTML(documentContent.Content);
 
             // We probably cannot use AutoMapper since we are dealing with too many different entities
             AnnotationInfo annotationInfo = new()
             {
-                DocumentText = documentContent.Content,
+                SourceDocumentContent = documentContent.Content,
+                DocumentToRender = preprocessingResult.docToRender,
+                TagStartPositions = preprocessingResult.openingTagPositions,
+                TagLengths = preprocessingResult.openingTagLengths,
                 Note = annotation.Note,
                 State = annotation.State,
                 Type = IsHtml(documentContent.Content) ? EDocumentType.HTML : EDocumentType.TEXT
@@ -132 +139 @@
             return annotationInfo;
         }
 
+        private (string docToRender, int[] openingTagPositions, int[] openingTagLengths, int[] closingTagPositions, int[] closingTagLengths) PreprocessHTML(string htmlSource)
+        {
+            var docOriginal = new HtmlDocument();
+            docOriginal.LoadHtml(htmlSource);
+            var docToEdit = new HtmlDocument();
+            docToEdit.LoadHtml(htmlSource);
+
+            string idAttributeName = "aswi-tag-id";
+
+            var descendantsOriginal = docOriginal.DocumentNode.DescendantsAndSelf();
+            var descendantsToEdit = docToEdit.DocumentNode.DescendantsAndSelf();
+
+            List<int> tagStartPositions = new();
+            List<int> tagStartLengths = new();
+
+
+            List<int> tagClosingPositions = new();
+            List<int> tagClosingLengths = new();
+
+            int currentId = 0;
+
+            var zipped = descendantsOriginal.Zip(descendantsToEdit, (orig, toEdit) => new { Original = orig, ToEdit = toEdit });
+            foreach (var node in zipped)
+            {
+                var originalNode = node.Original;
+                var toEditNode = node.ToEdit;
+
+                if (originalNode.Name.Contains("#"))
+                {
+                    continue;
+                }
+
+                tagStartPositions.Add(originalNode.OuterStartIndex);
+                tagStartLengths.Add(originalNode.OuterStartIndex - originalNode.InnerStartIndex);
+                currentId = tagStartPositions.Count - 1;
+                toEditNode.Attributes.Add(idAttributeName, currentId.ToString());
+
+                tagClosingPositions.Add(originalNode.InnerStartIndex + originalNode.InnerLength);
+                tagClosingLengths.Add((originalNode.OuterStartIndex + originalNode.OuterLength) - (originalNode.InnerStartIndex + originalNode.InnerLength));
+            }
+
+            string docToRender = docToEdit.DocumentNode.OuterHtml;
+            HtmlSanitizer sanitizer = new HtmlSanitizer();
+            sanitizer.AllowedAttributes.Clear();
+            sanitizer.AllowedAttributes.Add(idAttributeName);
+
+            docToRender = sanitizer.Sanitize(docToRender);
+
+            return (docToRender, tagStartPositions.ToArray(), tagStartLengths.ToArray(), tagClosingPositions.ToArray(), tagClosingLengths.ToArray());
+        }
+
         // TODO temporary
         private bool IsHtml(string text)
         {

Backend/Core/Services/DocumentService/DocumentServiceEF.cs

@@ -11 +11 @@
 using System.Web;
 using AutoMapper;
 using Models.Users;
+using Ganss.XSS;
 
 namespace Core.Services.DocumentService
 {

Backend/Models/Annotations/AnnotationInfo.cs

@@ -10 +10 @@
 {
     public class AnnotationInfo
     {
-        public string DocumentText { get; set; }
+        public string SourceDocumentContent { get; set; }
+        public string DocumentToRender { get; set; }
+        public int[] TagStartPositions { get; set; }
+        public int[] TagLengths { get; set; }
         public EState State { get; set; }
         public EDocumentType Type { get; set; }
         public string Note { get; set; }