Make the Acceptable Ads link clickable

src/org/adblockplus/android/Preferences.java

 /*
  * This file is part of Adblock Plus <http://adblockplus.org/>,
  * Copyright (C) 2006-2013 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 26 matching lines @@
 import android.content.SharedPreferences;
 import android.content.pm.PackageManager.NameNotFoundException;
 import android.content.res.AssetManager;
 import android.net.Uri;
 import android.os.Build;
 import android.os.Bundle;
 import android.os.IBinder;
 import android.preference.ListPreference;
 import android.preference.PreferenceManager;
 import android.text.Html;
+import android.text.TextUtils;
 import android.text.format.DateFormat;
 import android.text.method.LinkMovementMethod;
 import android.util.Log;
 import android.view.View;
 import android.view.ViewGroup;
 import android.widget.TextView;
 
 import com.actionbarsherlock.view.Menu;
 import com.actionbarsherlock.view.MenuInflater;
 import com.actionbarsherlock.view.MenuItem;
@@ skipping 88 matching lines @@
     if (subscriptions.length > 0)
     {
       current = subscriptions[0];
     }
 
     boolean firstRun = firstRunActionsPending && application.isFirstRun();
     firstRunActionsPending = false;
 
     if (firstRun && current != null)
     {
-      final String message = String.format(getString(R.string.msg_subscription_offer, current.title))
-          .replace("<a>", "<a href=\"" + getString(R.string.acceptable_ads_url) + "\">");

[Wladimir Palant, 2013/11/26 09:35:54]

This is a security vulnerability, please don't allow localizers to inject random
HTML tags into our UI. You need to escape entities in the string and then
replace &lt;a&gt;(.*?)&lt;/a&gt; by <a href="...">\1</a> - like we do it in
Firefox or Chrome. Note that HTML entities need to be escaped in the URL you
insert as well. The right function to do this seems to be
android.text.TextUtils.htmlEncode().

[Felix Dahlke, 2013/11/26 10:25:50]

Done. I had a feeling I wouldn't get away with this... :)

+      final String url = TextUtils.htmlEncode(application.getAcceptableAdsUrl());
+      final String rawMessage = String.format(getString(R.string.msg_subscription_offer, current.title));
+      final String message = TextUtils.htmlEncode(rawMessage)
+          .replaceAll("&lt;a&gt;(.*?)&lt;/a&gt;", "<a href=\"" + url + "\">$1</a>");
       final TextView messageView = new TextView(this);
       messageView.setText(Html.fromHtml(message));
       messageView.setMovementMethod(LinkMovementMethod.getInstance());
       final int padding = 10;

[Felix Dahlke, 2013/11/26 09:21:52]

I'm not a big fan of hard coding style properties, but I think the only
alternative would be to have a proper xml-defined dialog. I'd rather do that in
a follow-up.

       messageView.setPadding(padding, padding, padding, padding);
       new AlertDialog.Builder(this).setTitle(R.string.install_name)
           .setView(messageView)
           .setIcon(android.R.drawable.ic_dialog_info)
           .setPositiveButton(R.string.ok, null).create().show();
     }
 
     // Enable manual subscription refresh
     subscriptionList.setOnRefreshClickListener(new View.OnClickListener()
     {
@@ skipping 372 matching lines @@
         showConfigurationMsg(getString(R.string.msg_configuration));
     }
 
     public void onServiceDisconnected(ComponentName className)
     {
       proxyService = null;
       Log.d(TAG, "Proxy service disconnected");
     }
   };
 }