From 7c37734fec508f82f757c299175674b755d0ac71 Mon Sep 17 00:00:00 2001
From: neobooru <50623835+neobooru@users.noreply.github.com>
Date: Sat, 10 Apr 2021 15:10:39 +0200
Subject: [PATCH 1/2] client: rename escapeColons to escapeTagName and also
 escape dots

---
 client/html/post_readonly_sidebar.tpl               | 2 +-
 client/html/tag_delete.tpl                          | 2 +-
 client/html/tag_summary.tpl                         | 2 +-
 client/js/controllers/pool_controller.js            | 2 +-
 client/js/controllers/pool_create_controller.js     | 2 +-
 client/js/controllers/tag_controller.js             | 2 +-
 client/js/controls/post_readonly_sidebar_control.js | 2 +-
 client/js/controls/tag_input_control.js             | 2 +-
 client/js/util/uri.js                               | 6 +++---
 9 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/client/html/post_readonly_sidebar.tpl b/client/html/post_readonly_sidebar.tpl
index 178b1d24..cfbfd103 100644
--- a/client/html/post_readonly_sidebar.tpl
+++ b/client/html/post_readonly_sidebar.tpl
@@ -92,7 +92,7 @@
                             --></a><!--
                         --><% } %><!--
                         --><% if (ctx.canListPosts) { %><!--
-                            --><a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeColons(tag.names[0])}) %>' class='<%= ctx.makeCssName(tag.category, 'tag') %>'><!--
+                            --><a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeTagName(tag.names[0])}) %>' class='<%= ctx.makeCssName(tag.category, 'tag') %>'><!--
                         --><% } %><!--
                             --><%- ctx.getPrettyName(tag.names[0]) %>&#32;<!--
                         --><% if (ctx.canListPosts) { %><!--
diff --git a/client/html/tag_delete.tpl b/client/html/tag_delete.tpl
index 2ea8cbaa..f4206996 100644
--- a/client/html/tag_delete.tpl
+++ b/client/html/tag_delete.tpl
@@ -1,6 +1,6 @@
 <div class='tag-delete'>
     <form>
-        <p>This tag has <a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeColons(ctx.tag.names[0])}) %>'><%- ctx.tag.postCount %> usage(s)</a>.</p>
+        <p>This tag has <a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeTagName(ctx.tag.names[0])}) %>'><%- ctx.tag.postCount %> usage(s)</a>.</p>
 
         <ul class='input'>
             <li>
diff --git a/client/html/tag_summary.tpl b/client/html/tag_summary.tpl
index 9929a44a..06e25479 100644
--- a/client/html/tag_summary.tpl
+++ b/client/html/tag_summary.tpl
@@ -36,6 +36,6 @@
     <section class='description'>
         <hr/>
         <%= ctx.makeMarkdown(ctx.tag.description || 'This tag has no description yet.') %>
-        <p>This tag has <a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeColons(ctx.tag.names[0])}) %>'><%- ctx.tag.postCount %> usage(s)</a>.</p>
+        <p>This tag has <a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeTagName(ctx.tag.names[0])}) %>'><%- ctx.tag.postCount %> usage(s)</a>.</p>
     </section>
 </div>
diff --git a/client/js/controllers/pool_controller.js b/client/js/controllers/pool_controller.js
index 68441712..ad0b9561 100644
--- a/client/js/controllers/pool_controller.js
+++ b/client/js/controllers/pool_controller.js
@@ -52,7 +52,7 @@ class PoolController {
                     canMerge: api.hasPrivilege("pools:merge"),
                     canDelete: api.hasPrivilege("pools:delete"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("change", (e) =>
diff --git a/client/js/controllers/pool_create_controller.js b/client/js/controllers/pool_create_controller.js
index 7140aac8..3ae3721b 100644
--- a/client/js/controllers/pool_create_controller.js
+++ b/client/js/controllers/pool_create_controller.js
@@ -26,7 +26,7 @@ class PoolCreateController {
                 this._view = new PoolCreateView({
                     canCreate: api.hasPrivilege("pools:create"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("submit", (e) =>
diff --git a/client/js/controllers/tag_controller.js b/client/js/controllers/tag_controller.js
index 0928b3ff..dfd80bc2 100644
--- a/client/js/controllers/tag_controller.js
+++ b/client/js/controllers/tag_controller.js
@@ -56,7 +56,7 @@ class TagController {
                     canMerge: api.hasPrivilege("tags:merge"),
                     canDelete: api.hasPrivilege("tags:delete"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("change", (e) =>
diff --git a/client/js/controls/post_readonly_sidebar_control.js b/client/js/controls/post_readonly_sidebar_control.js
index 9bc767fa..d11fa925 100644
--- a/client/js/controls/post_readonly_sidebar_control.js
+++ b/client/js/controls/post_readonly_sidebar_control.js
@@ -28,7 +28,7 @@ class PostReadonlySidebarControl extends events.EventTarget {
                 canListPosts: api.hasPrivilege("posts:list"),
                 canEditPosts: api.hasPrivilege("posts:edit"),
                 canViewTags: api.hasPrivilege("tags:view"),
-                escapeColons: uri.escapeColons,
+                escapeTagName: uri.escapeTagName,
                 extractRootDomain: uri.extractRootDomain,
                 getPrettyName: misc.getPrettyName,
             })
diff --git a/client/js/controls/tag_input_control.js b/client/js/controls/tag_input_control.js
index 7d069f9a..2207f416 100644
--- a/client/js/controls/tag_input_control.js
+++ b/client/js/controls/tag_input_control.js
@@ -305,7 +305,7 @@ class TagInputControl extends events.EventTarget {
         searchLinkNode.setAttribute(
             "href",
             uri.formatClientLink("posts", {
-                query: uri.escapeColons(tag.names[0]),
+                query: uri.escapeTagName(tag.names[0]),
             })
         );
         searchLinkNode.textContent = tag.names[0] + " ";
diff --git a/client/js/util/uri.js b/client/js/util/uri.js
index 16fa4f8d..8064cdbd 100644
--- a/client/js/util/uri.js
+++ b/client/js/util/uri.js
@@ -85,14 +85,14 @@ function extractRootDomain(url) {
     return domain;
 }
 
-function escapeColons(text) {
-    return text.replace(new RegExp(":", "g"), "\\:");
+function escapeTagName(text) {
+    return text.replace(/:/g, "\\:").replace(/\./g, "\\.");
 }
 
 module.exports = {
     formatClientLink: formatClientLink,
     formatApiLink: formatApiLink,
-    escapeColons: escapeColons,
+    escapeTagName: escapeTagName,
     escapeParam: escapeParam,
     unescapeParam: unescapeParam,
     extractHostname: extractHostname,

From 4ce72fa712918934fec019743dabc3387b2b6bcc Mon Sep 17 00:00:00 2001
From: neobooru <50623835+neobooru@users.noreply.github.com>
Date: Mon, 12 Apr 2021 10:42:58 +0200
Subject: [PATCH 2/2] client/tags: escape dots in search term and don't allow
 '.' and '..' as tags

---
 client/js/controls/tag_input_control.js | 3 ++-
 client/js/util/misc.js                  | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/client/js/controls/tag_input_control.js b/client/js/controls/tag_input_control.js
index 2207f416..1ac1cb3e 100644
--- a/client/js/controls/tag_input_control.js
+++ b/client/js/controls/tag_input_control.js
@@ -163,7 +163,8 @@ class TagInputControl extends events.EventTarget {
 
     addTagByName(name, source) {
         name = name.trim();
-        if (!name) {
+        // Tags `.` and `..` are not allowed, see https://github.com/rr-/szurubooru/pull/390
+        if (!name || name == "." || name == "..") {
             return;
         }
         return Tag.get(name).then(
diff --git a/client/js/util/misc.js b/client/js/util/misc.js
index 4f9d6d33..756ad84b 100644
--- a/client/js/util/misc.js
+++ b/client/js/util/misc.js
@@ -187,7 +187,7 @@ function arraysDiffer(source1, source2, orderImportant) {
 }
 
 function escapeSearchTerm(text) {
-    return text.replace(/([a-z_-]):/g, "$1\\:");
+    return text.replace(/([a-z_-]):/g, "$1\\:").replace(/\./g, "\\.");
 }
 
 function dataURItoBlob(dataURI) {