Add sanitize duplicated domains in rich text form input (fixes #2019)

app/assets/javascripts/app/lib/app_post/utils.coffee

@@ -262,6 +262,10 @@ class App.Utils
     # remove word markup
     @_removeWordMarkup(html)
 
+    # strip out browser-inserted (broken) link
+    # (see https://github.com/zammad/zammad/issues/2019)
+    @_stripDoubleDomainAnchors(html)
+
     # remove tags, keep content
     html.find('font, small, time, form, label').replaceWith( ->
       $(@).contents()
@@ -395,6 +399,15 @@ class App.Utils
       return window.word_filter(html)
     html
 
+  @_stripDoubleDomainAnchors: (html) ->
+    html.find('a').each( ->
+      origHref  = $(@).attr('href')
+      return if !origHref?
+
+      fixedHref = origHref.replace(/^https?:\/\/.*(?=(https?|#{config.http_type}):\/\/)/, '')
+      if origHref != fixedHref then $(@).attr('href', fixedHref)
+    )
+
   # signatureNeeded = App.Utils.signatureCheck(message, signature)
   @signatureCheck: (message, signature) ->
     messageText   = $('<div>' + message + '</div>').text().trim()

db/migrate/20180716060129_issue_2019_fix_double_domain_links_in_trigger_emails.rb

@@ -0,0 +1,16 @@
+class Issue2019FixDoubleDomainLinksInTriggerEmails < ActiveRecord::Migration[5.1]
+  DOUBLE_DOMAIN_REGEX = %r{(?<=<a href=")https?://[^"]+(?=(https?|\#{config\.http_type})://.+?".*?>)}
+
+  def up
+    Trigger.where('perform LIKE ?', '%notification.email: %')
+           .find_each do |t|
+             email_response = t.perform['notification.email']
+             next if email_response.blank? || !email_response['body']&.match(DOUBLE_DOMAIN_REGEX)
+
+             email_response['body'] = email_response['body'].gsub(DOUBLE_DOMAIN_REGEX, '')
+             next if !t.perform_changed?
+
+             t.save
+           end
+  end
+end

public/assets/tests/html_utils.js

@@ -651,6 +651,12 @@ test("htmlCleanup", function() {
   result = App.Utils.htmlCleanup(source)
   equal(result.get(0).outerHTML, should, source)
 
+  // strip out browser-inserted (broken) link (see https://github.com/zammad/zammad/issues/2019)
+  source = "<div><a href=\"https://example.com/#{config.http_type}://#{config.fqdn}/#ticket/zoom/#{ticket.id}\">test</a></div>"
+  should = "<a href=\"#{config.http_type}://#{config.fqdn}/#ticket/zoom/#{ticket.id}\">test</a>"
+  result = App.Utils.htmlCleanup(source)
+  equal(result.html(), should, source)
+
   source = "<table bgcolor=\"green\" aaa=\"1\" style=\"color: red\"><thead><tr style=\"margin-top: 10px\"><th colspan=\"2\" abc=\"a\" style=\"margin-top: 12px\">aaa</th></tr></thead><tbody><tr><td>value</td></tr></tbody></table>"
   should = "<table bgcolor=\"green\" style=\"color:red;\"><thead><tr style=\"margin-top:10px;\"><th colspan=\"2\" style=\"margin-top:12px;\">aaa</th></tr></thead><tbody><tr><td>value</td></tr></tbody></table>"
   result = App.Utils.htmlCleanup(source)
@@ -2727,4 +2733,4 @@ var htmlImage2DataUrlTest = function() {
 }
 $('#image2text img').one('load', htmlImage2DataUrlTest)
 
-}
+}