appview/pages: don't sanitize plaintext readmes #361

merged
opened by anirudh.fi targeting master from push-ormxrmmzomqu

Also, sanitize the raw markdown before rendering.

Signed-off-by: Anirudh Oppiliappan anirudh@tangled.sh

Changed files
+4 -6
appview
pages
templates
repo
+2 -4
appview/pages/pages.go
···
"github.com/bluesky-social/indigo/atproto/syntax"
"github.com/go-git/go-git/v5/plumbing"
"github.com/go-git/go-git/v5/plumbing/object"
-
"github.com/microcosm-cc/bluemonday"
)
//go:embed templates/* static
···
ext := filepath.Ext(params.ReadmeFileName)
switch ext {
case ".md", ".markdown", ".mdown", ".mkdn", ".mkd":
+
htmlString = p.rctx.Sanitize(htmlString)
htmlString = p.rctx.RenderMarkdown(params.Readme)
params.Raw = false
-
params.HTMLReadme = template.HTML(p.rctx.Sanitize(htmlString))
+
params.HTMLReadme = template.HTML(htmlString)
default:
-
htmlString = string(params.Readme)
params.Raw = true
-
params.HTMLReadme = template.HTML(bluemonday.NewPolicy().Sanitize(htmlString))
}
}
+2 -2
appview/pages/templates/repo/index.html
···
{{ end }}
{{ define "repoAfter" }}
-
{{- if .HTMLReadme -}}
+
{{- if or .HTMLReadme .Readme -}}
<section
class="p-6 mt-4 rounded-br rounded-bl bg-white dark:bg-gray-800 dark:text-white drop-shadow-sm w-full mx-auto overflow-auto {{ if not .Raw }}
prose dark:prose-invert dark:[&_pre]:bg-gray-900
···
{{ end }}"
>
<article class="{{ if .Raw }}whitespace-pre{{ end }}">{{- if .Raw -}}<pre class="dark:bg-gray-800 dark:text-white overflow-x-auto">
-
{{- .HTMLReadme -}}
+
{{- .Readme -}}
</pre>
{{- else -}}
{{ .HTMLReadme }}