feat(editor): add external link warning page

A malicious user could modify a valid looking link (for example of the editor UI)
to point to a malicous site, by using overlays and CSS. Since CSS should stay
enabled, we need to make the user aware of possible risks when leaving the
HedgeDoc instance, in order to protect them from credential-theft.

This commit adds a new interstitial page for external links, that shows the
target URL and asks the user, whether they really want to continue.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

lib/links.js

@@ -0,0 +1,28 @@
+module.exports = {
+  serveLinkWarningPage: function (req, res) {
+    let targetURL = typeof req.query.url === 'string' ? req.query.url : ''
+    let noteURL = typeof req.query.note === 'string' ? req.query.note : ''
+    if (noteURL !== '' && !/^[\w-]+$/.test(noteURL)) {
+      noteURL = ''
+    }
+    let valid = false
+    try {
+      targetURL = decodeURIComponent(targetURL)
+      const parsed = new URL(targetURL)
+      valid = ['http:', 'https:'].includes(parsed.protocol)
+      targetURL = parsed.href
+    } catch (err) {
+      valid = false
+    }
+    res.set({
+      'Cache-Control': 'no-store'
+    })
+    res.render('link.ejs', {
+      title: 'External link',
+      valid,
+      noteURL,
+      targetURL,
+      opengraph: []
+    })
+  }
+}

lib/web/baseRouter.js

@@ -8,6 +8,8 @@ const baseRouter = module.exports = Router()
 
 const errors = require('../errors')
 
+const links = require('../links')
+
 // get index
 baseRouter.get('/', response.showIndex)
 // get 403 forbidden
@@ -22,3 +24,5 @@ baseRouter.get('/404', function (req, res) {
 baseRouter.get('/500', function (req, res) {
   errors.errorInternalError(res)
 })
+// get external link warning page
+baseRouter.get('/_link', links.serveLinkWarningPage)