AO3-7637 Prevent invalid links from breaking eBook downloads

config/config.yml

@@ -334,7 +334,7 @@ COMMENT_MODERATION_THRESHOLD: 10
 EDITED_COMMENT_SPAM_CHECK_THRESHOLD: 10
 
 # SANITIZER VERSION
-SANITIZER_VERSION: 4
+SANITIZER_VERSION: 5
 
 # parameters that must be natural integers and their default values
 NONZERO_INTEGER_PARAMETERS:

config/initializers/gem-plugin_config/sanitizer_config.rb

@@ -67,5 +67,16 @@ module Config
     rescue URI::InvalidURIError
       # do nothing, the sanitizer will handle it
     end
+
+    # On a elements, blank out hrefs that aren't valid URLs
+    INVALID_HREF_TRANSFORMER = lambda do |env|
+      return unless env[:node_name] == "a" && env[:node]["href"]
+
+      host = Addressable::URI.parse(env[:node]["href"]).host
+
+      env[:node]["href"] = "" if host&.start_with?("[") && !host&.end_with?("]")
+    rescue Addressable::URI::InvalidURIError
+      env[:node]["href"] = ""
+    end
   end
 end

lib/html_cleaner.rb

@@ -59,7 +59,8 @@ def sanitize_value(field, value)
       # We're allowing users to use HTML in this field
       transformers = [
         Sanitize::Config::OPEN_ATTRIBUTE_TRANSFORMER,
-        Sanitize::Config::RELATIVE_IMAGE_PATH_TRANSFORMER
+        Sanitize::Config::RELATIVE_IMAGE_PATH_TRANSFORMER,
+        Sanitize::Config::INVALID_HREF_TRANSFORMER
       ]
       if ArchiveConfig.FIELDS_ALLOWING_MEDIA_EMBEDS.include?(field.to_s)
         transformers << OtwSanitize::EmbedSanitizer.transformer

spec/lib/html_cleaner_spec.rb

@@ -444,6 +444,23 @@ def one_cell_table(content)
           end
         end
 
+        context "when given an <a> tag with an invalid href" do
+          it "should clean up an invalid href while preserving the link text" do
+            result = sanitize_value(field, "<a href='https://[https://test.archiveofourown.org/users/testy]' rel='nofollow'>testy</a>")
+            expect(result).to eq("<p><a href=\"\" rel=\"nofollow\">testy</a></p>")
+          end
+
+          it "should not clean up a valid href" do
+            result = sanitize_value(field, "<a href='https://test.archiveofourown.org/users/testy' rel='nofollow'>testy</a>")
+            expect(result).to eq("<p><a href=\"https://test.archiveofourown.org/users/testy\" rel=\"nofollow\">testy</a></p>")
+          end
+
+          it "should not clean up a valid href with non-ASCII characters" do
+            result = sanitize_value(field, "<a href='https://test.archiveofourown.org/users/café' rel='nofollow'>testy</a>")
+            expect(result).to eq("<p><a href=\"https://test.archiveofourown.org/users/café\" rel=\"nofollow\">testy</a></p>")
+          end
+        end
+
         # These are from https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9
         it 'should not preserve the content of removed `math` elements' do
           content = sanitize_value(field, '<math>hello! <script>alert(0)</script></math>')