forked from
tangled.org/core
Mirror of @tangled.org/core. Running on a Raspberry Pi Zero 2 (Please be gentle).
appview/pages: rework sanitizer
- initialize sanitizer once, and reuse for life
- improve policies, and allow sanitizer to hold multiple policies
(this will come in handy, for PR titles, repo description, profiles
description etc.)
- add general safe items to allow list, most of these are generated by
goldmark GFM
Signed-off-by: oppiliappan <me@oppi.li>
authored by
oppiliappan
and committed by
Tangled
f5c2ed8f
55f1fc1f
+64
-13
+55
-6
appview/pages/markup/markdown.go
+55
-6
appview/pages/markup/markdown.go
···
7
7
"io"
8
8
"net/url"
9
9
"path"
10
+
"regexp"
10
11
"strings"
11
12
12
13
"github.com/microcosm-cc/bluemonday"
···
41
40
repoinfo.RepoInfo
42
41
IsDev bool
43
42
RendererType RendererType
43
+
Sanitizer Sanitizer
44
+
}
45
+
46
+
type Sanitizer struct {
47
+
defaultPolicy *bluemonday.Policy
44
48
}
45
49
46
50
func (rctx *RenderContext) RenderMarkdown(source string) string {
···
151
145
}
152
146
}
153
147
154
-
func (rctx *RenderContext) Sanitize(html string) string {
148
+
func (rctx *RenderContext) SanitizeDefault(html string) string {
149
+
return rctx.Sanitizer.defaultPolicy.Sanitize(html)
150
+
}
151
+
152
+
func NewSanitizer() Sanitizer {
153
+
return Sanitizer{
154
+
defaultPolicy: defaultPolicy(),
155
+
}
156
+
}
157
+
func defaultPolicy() *bluemonday.Policy {
155
158
policy := bluemonday.UGCPolicy()
156
159
160
+
// Allow generally safe attributes
161
+
generalSafeAttrs := []string{
162
+
"abbr", "accept", "accept-charset",
163
+
"accesskey", "action", "align", "alt",
164
+
"aria-describedby", "aria-hidden", "aria-label", "aria-labelledby",
165
+
"axis", "border", "cellpadding", "cellspacing", "char",
166
+
"charoff", "charset", "checked",
167
+
"clear", "cols", "colspan", "color",
168
+
"compact", "coords", "datetime", "dir",
169
+
"disabled", "enctype", "for", "frame",
170
+
"headers", "height", "hreflang",
171
+
"hspace", "ismap", "label", "lang",
172
+
"maxlength", "media", "method",
173
+
"multiple", "name", "nohref", "noshade",
174
+
"nowrap", "open", "prompt", "readonly", "rel", "rev",
175
+
"rows", "rowspan", "rules", "scope",
176
+
"selected", "shape", "size", "span",
177
+
"start", "summary", "tabindex", "target",
178
+
"title", "type", "usemap", "valign", "value",
179
+
"vspace", "width", "itemprop",
180
+
}
181
+
182
+
generalSafeElements := []string{
183
+
"h1", "h2", "h3", "h4", "h5", "h6", "h7", "h8", "br", "b", "i", "strong", "em", "a", "pre", "code", "img", "tt",
184
+
"div", "ins", "del", "sup", "sub", "p", "ol", "ul", "table", "thead", "tbody", "tfoot", "blockquote", "label",
185
+
"dl", "dt", "dd", "kbd", "q", "samp", "var", "hr", "ruby", "rt", "rp", "li", "tr", "td", "th", "s", "strike", "summary",
186
+
"details", "caption", "figure", "figcaption",
187
+
"abbr", "bdo", "cite", "dfn", "mark", "small", "span", "time", "video", "wbr",
188
+
}
189
+
190
+
policy.AllowAttrs(generalSafeAttrs...).OnElements(generalSafeElements...)
191
+
157
192
// video
158
-
policy.AllowElements("video")
159
-
policy.AllowAttrs("controls").OnElements("video")
160
-
policy.AllowElements("source")
161
-
policy.AllowAttrs("src", "type").OnElements("source")
193
+
policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")
194
+
195
+
// checkboxes
196
+
policy.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
197
+
policy.AllowAttrs("checked", "disabled", "data-source-position").OnElements("input")
162
198
163
199
// centering content
164
200
policy.AllowElements("center")
···
221
173
"margin-top",
222
174
"margin-bottom",
223
175
)
224
-
return policy.Sanitize(html)
176
+
177
+
return policy
225
178
}
226
179
227
180
type MarkdownTransformer struct {
+9
-7
appview/pages/pages.go
+9
-7
appview/pages/pages.go
···
59
59
IsDev: config.Core.Dev,
60
60
CamoUrl: config.Camo.Host,
61
61
CamoSecret: config.Camo.SharedSecret,
62
+
Sanitizer: markup.NewSanitizer(),
62
63
}
63
64
64
65
p := &Pages{
···
518
517
p.rctx.RendererType = markup.RendererTypeRepoMarkdown
519
518
520
519
if params.ReadmeFileName != "" {
521
-
var htmlString string
522
520
ext := filepath.Ext(params.ReadmeFileName)
523
521
switch ext {
524
522
case ".md", ".markdown", ".mdown", ".mkdn", ".mkd":
525
-
htmlString = p.rctx.Sanitize(htmlString)
526
-
htmlString = p.rctx.RenderMarkdown(params.Readme)
527
523
params.Raw = false
528
-
params.HTMLReadme = template.HTML(htmlString)
524
+
htmlString := p.rctx.RenderMarkdown(params.Readme)
525
+
sanitized := p.rctx.SanitizeDefault(htmlString)
526
+
params.HTMLReadme = template.HTML(sanitized)
529
527
default:
530
528
params.Raw = true
531
529
}
···
663
663
p.rctx.RepoInfo = params.RepoInfo
664
664
p.rctx.RendererType = markup.RendererTypeRepoMarkdown
665
665
htmlString := p.rctx.RenderMarkdown(params.Contents)
666
-
params.RenderedContents = template.HTML(p.rctx.Sanitize(htmlString))
666
+
sanitized := p.rctx.SanitizeDefault(htmlString)
667
+
params.RenderedContents = template.HTML(sanitized)
667
668
}
668
669
}
669
670
···
1171
1170
if params.ShowRendered {
1172
1171
switch markup.GetFormat(params.String.Filename) {
1173
1172
case markup.FormatMarkdown:
1174
-
p.rctx.RendererType = markup.RendererTypeDefault
1173
+
p.rctx.RendererType = markup.RendererTypeRepoMarkdown
1175
1174
htmlString := p.rctx.RenderMarkdown(params.String.Contents)
1176
-
params.RenderedContents = template.HTML(p.rctx.Sanitize(htmlString))
1175
+
sanitized := p.rctx.SanitizeDefault(htmlString)
1176
+
params.RenderedContents = template.HTML(sanitized)
1177
1177
}
1178
1178
}
1179
1179