fix: xss on flags page via ban reason

* feat: als

* fix: up test timeout

* fix: don't overwrite caller if it already exists

* fix: up test timeout for psql

install/package.json

@@ -2,7 +2,7 @@
     "name": "nodebb",
     "license": "GPL-3.0",
     "description": "NodeBB Forum",
-    "version": "1.17.1",
+    "version": "1.17.2",
     "homepage": "http://www.nodebb.org",
     "repository": {
         "type": "git",
@@ -88,7 +88,7 @@
         "nodebb-plugin-dbsearch": "5.0.2",
         "nodebb-plugin-emoji": "^3.5.0",
         "nodebb-plugin-emoji-android": "2.0.5",
-        "nodebb-plugin-markdown": "8.14.0",
+        "nodebb-plugin-markdown": "8.14.1",
         "nodebb-plugin-mentions": "2.13.11",
         "nodebb-plugin-spam-be-gone": "0.7.9",
         "nodebb-rewards-essentials": "0.1.5",
@@ -182,4 +182,4 @@
             "url": "https://github.com/barisusakli"
         }
     ]
-}
+}

src/als.js

@@ -0,0 +1,7 @@
+'use strict';
+
+const { AsyncLocalStorage } = require('async_hooks');
+
+const asyncLocalStorage = new AsyncLocalStorage();
+
+module.exports = asyncLocalStorage;

src/flags.js

@@ -776,7 +776,7 @@ async function mergeBanHistory(history, targetUid, uids) {
 			meta: [
 				{
 					key: '[[user:banned]]',
-					value: cur.reason,
+					value: validator.escape(String(cur.reason)),
 					labelClass: 'danger',
 				},
 				{

src/plugins/hooks.js

@@ -96,6 +96,10 @@ Hooks.fire = async function (hook, params) {
 		winston.warn(`[plugins] Unknown hookType: ${hookType}, hook : ${hook}`);
 		return;
 	}
+	if (params && typeof params === 'object' && !params.hasOwnProperty('caller')) {
+		const als = require('../als');
+		params.caller = als.getStore();
+	}
 	const result = await hookTypeToMethod[hookType](hook, hookList, params);
 
 	if (hook !== 'action:plugins.firehook' && hook !== 'filter:plugins.firehook') {

src/socket.io/index.js

@@ -73,7 +73,8 @@ function onConnection(socket) {
 	onConnect(socket);
 	socket.onAny((event, ...args) => {
 		const payload = { data: [event].concat(args) };
-		onMessage(socket, payload);
+		const als = require('../als');
+		als.run({ uid: socket.uid }, onMessage, socket, payload);
 	});
 
 	socket.on('disconnect', () => {

src/webserver.js

@@ -171,6 +171,10 @@ function setupExpressApp(app) {
 	app.use(middleware.addHeaders);
 	app.use(middleware.processRender);
 	auth.initialize(app, middleware);
+	const als = require('./als');
+	app.use((req, res, next) => {
+		als.run({ uid: req.uid }, next);
+	});
 	app.use(middleware.autoLocale);	// must be added after auth middlewares are added
 
 	const toobusy = require('toobusy-js');

test/database/sorted.js

@@ -334,7 +334,7 @@ describe('Sorted Set methods', () => {
 		});
 
 		it('should work with big arrays (length > 100) ', async function () {
-			this.timeout(50000);
+			this.timeout(100000);
 			const keys = [];
 			for (let i = 0; i < 400; i++) {
 				/* eslint-disable no-await-in-loop */

test/notifications.js

@@ -359,7 +359,7 @@ describe('Notifications', () => {
 						assert(nids.includes(nid));
 						done();
 					});
-				}, 1500);
+				}, 3000);
 			});
 		});
 	});