back round 0 view raw

appview/pages: rework sanitizer #491

merged

opened by

oppi.li 4 months ago targeting master from push-stktrzvlltpw

initialize sanitizer once, and reuse for life
improve policies, and allow sanitizer to hold multiple policies (this will come in handy, for PR titles, repo description, profiles description etc.)
add general safe items to allow list, most of these are generated by goldmark GFM

Signed-off-by: oppiliappan me@oppi.li

options

unified split

Changed files

+64 -13

appview

pages

markup

markdown.go

pages.go

+55 -6

appview/pages/markup/markdown.go

···

       7
       7
        
       	"io"

     

       8
       8
        
       	"net/url"

     

       9
       9
        
       	"path"

     

       10
       10
       +
       	"regexp"

     

       10
       11
        
       	"strings"

     

       11
       12
        
       

     

       12
       13
        
       	"github.com/microcosm-cc/bluemonday"

     
···

       40
       41
        
       	repoinfo.RepoInfo

     

       41
       42
        
       	IsDev        bool

     

       42
       43
        
       	RendererType RendererType

     

       44
       44
       +
       	Sanitizer    Sanitizer

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       type Sanitizer struct {

     

       48
       48
       +
       	defaultPolicy *bluemonday.Policy

     

       43
       49
        
       }

     

       44
       50
        
       

     

       45
       51
        
       func (rctx *RenderContext) RenderMarkdown(source string) string {

     
···

       145
       151
        
       	}

     

       146
       152
        
       }

     

       147
       153
        
       

     

       148
       148
       -
       func (rctx *RenderContext) Sanitize(html string) string {

     

       154
       154
       +
       func (rctx *RenderContext) SanitizeDefault(html string) string {

     

       155
       155
       +
       	return rctx.Sanitizer.defaultPolicy.Sanitize(html)

     

       156
       156
       +
       }

     

       157
       157
       +
       

     

       158
       158
       +
       func NewSanitizer() Sanitizer {

     

       159
       159
       +
       	return Sanitizer{

     

       160
       160
       +
       		defaultPolicy: defaultPolicy(),

     

       161
       161
       +
       	}

     

       162
       162
       +
       }

     

       163
       163
       +
       func defaultPolicy() *bluemonday.Policy {

     

       149
       164
        
       	policy := bluemonday.UGCPolicy()

     

       150
       165
        
       

     

       166
       166
       +
       	// Allow generally safe attributes

     

       167
       167
       +
       	generalSafeAttrs := []string{

     

       168
       168
       +
       		"abbr", "accept", "accept-charset",

     

       169
       169
       +
       		"accesskey", "action", "align", "alt",

     

       170
       170
       +
       		"aria-describedby", "aria-hidden", "aria-label", "aria-labelledby",

     

       171
       171
       +
       		"axis", "border", "cellpadding", "cellspacing", "char",

     

       172
       172
       +
       		"charoff", "charset", "checked",

     

       173
       173
       +
       		"clear", "cols", "colspan", "color",

     

       174
       174
       +
       		"compact", "coords", "datetime", "dir",

     

       175
       175
       +
       		"disabled", "enctype", "for", "frame",

     

       176
       176
       +
       		"headers", "height", "hreflang",

     

       177
       177
       +
       		"hspace", "ismap", "label", "lang",

     

       178
       178
       +
       		"maxlength", "media", "method",

     

       179
       179
       +
       		"multiple", "name", "nohref", "noshade",

     

       180
       180
       +
       		"nowrap", "open", "prompt", "readonly", "rel", "rev",

     

       181
       181
       +
       		"rows", "rowspan", "rules", "scope",

     

       182
       182
       +
       		"selected", "shape", "size", "span",

     

       183
       183
       +
       		"start", "summary", "tabindex", "target",

     

       184
       184
       +
       		"title", "type", "usemap", "valign", "value",

     

       185
       185
       +
       		"vspace", "width", "itemprop",

     

       186
       186
       +
       	}

     

       187
       187
       +
       

     

       188
       188
       +
       	generalSafeElements := []string{

     

       189
       189
       +
       		"h1", "h2", "h3", "h4", "h5", "h6", "h7", "h8", "br", "b", "i", "strong", "em", "a", "pre", "code", "img", "tt",

     

       190
       190
       +
       		"div", "ins", "del", "sup", "sub", "p", "ol", "ul", "table", "thead", "tbody", "tfoot", "blockquote", "label",

     

       191
       191
       +
       		"dl", "dt", "dd", "kbd", "q", "samp", "var", "hr", "ruby", "rt", "rp", "li", "tr", "td", "th", "s", "strike", "summary",

     

       192
       192
       +
       		"details", "caption", "figure", "figcaption",

     

       193
       193
       +
       		"abbr", "bdo", "cite", "dfn", "mark", "small", "span", "time", "video", "wbr",

     

       194
       194
       +
       	}

     

       195
       195
       +
       

     

       196
       196
       +
       	policy.AllowAttrs(generalSafeAttrs...).OnElements(generalSafeElements...)

     

       197
       197
       +
       

     

       151
       198
        
       	// video

     

       152
       152
       -
       	policy.AllowElements("video")

     

       153
       153
       -
       	policy.AllowAttrs("controls").OnElements("video")

     

       154
       154
       -
       	policy.AllowElements("source")

     

       155
       155
       -
       	policy.AllowAttrs("src", "type").OnElements("source")

     

       199
       199
       +
       	policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")

     

       200
       200
       +
       

     

       201
       201
       +
       	// checkboxes

     

       202
       202
       +
       	policy.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")

     

       203
       203
       +
       	policy.AllowAttrs("checked", "disabled", "data-source-position").OnElements("input")

     

       156
       204
        
       

     

       157
       205
        
       	// centering content

     

       158
       206
        
       	policy.AllowElements("center")

     
···

       173
       221
        
       		"margin-top",

     

       174
       222
        
       		"margin-bottom",

     

       175
       223
        
       	)

     

       176
       176
       -
       	return policy.Sanitize(html)

     

       224
       224
       +
       

     

       225
       225
       +
       	return policy

     

       177
       226
        
       }

     

       178
       227
        
       

     

       179
       228
        
       type MarkdownTransformer struct {

+9 -7

appview/pages/pages.go

···

       57
       57
        
       		IsDev:      config.Core.Dev,

     

       58
       58
        
       		CamoUrl:    config.Camo.Host,

     

       59
       59
        
       		CamoSecret: config.Camo.SharedSecret,

     

       60
       60
       +
       		Sanitizer:  markup.NewSanitizer(),

     

       60
       61
        
       	}

     

       61
       62
        
       

     

       62
       63
        
       	p := &Pages{

     
···

       522
       523
        
       	p.rctx.RendererType = markup.RendererTypeRepoMarkdown

     

       523
       524
        
       

     

       524
       525
        
       	if params.ReadmeFileName != "" {

     

       525
       525
       -
       		var htmlString string

     

       526
       526
        
       		ext := filepath.Ext(params.ReadmeFileName)

     

       527
       527
        
       		switch ext {

     

       528
       528
        
       		case ".md", ".markdown", ".mdown", ".mkdn", ".mkd":

     

       529
       529
       -
       			htmlString = p.rctx.Sanitize(htmlString)

     

       530
       530
       -
       			htmlString = p.rctx.RenderMarkdown(params.Readme)

     

       531
       529
        
       			params.Raw = false

     

       532
       532
       -
       			params.HTMLReadme = template.HTML(htmlString)

     

       530
       530
       +
       			htmlString := p.rctx.RenderMarkdown(params.Readme)

     

       531
       531
       +
       			sanitized := p.rctx.SanitizeDefault(htmlString)

     

       532
       532
       +
       			params.HTMLReadme = template.HTML(sanitized)

     

       533
       533
        
       		default:

     

       534
       534
        
       			params.Raw = true

     

       535
       535
        
       		}

     
···

       668
       668
        
       			p.rctx.RepoInfo = params.RepoInfo

     

       669
       669
        
       			p.rctx.RendererType = markup.RendererTypeRepoMarkdown

     

       670
       670
        
       			htmlString := p.rctx.RenderMarkdown(params.Contents)

     

       671
       671
       -
       			params.RenderedContents = template.HTML(p.rctx.Sanitize(htmlString))

     

       671
       671
       +
       			sanitized := p.rctx.SanitizeDefault(htmlString)

     

       672
       672
       +
       			params.RenderedContents = template.HTML(sanitized)

     

       672
       673
        
       		}

     

       673
       674
        
       	}

     

       674
       675
        
       

     
···

       1182
       1183
        
       	if params.ShowRendered {

     

       1183
       1184
        
       		switch markup.GetFormat(params.String.Filename) {

     

       1184
       1185
        
       		case markup.FormatMarkdown:

     

       1185
       1185
       -
       			p.rctx.RendererType = markup.RendererTypeDefault

     

       1186
       1186
       +
       			p.rctx.RendererType = markup.RendererTypeRepoMarkdown

     

       1186
       1187
        
       			htmlString := p.rctx.RenderMarkdown(params.String.Contents)

     

       1187
       1187
       -
       			params.RenderedContents = template.HTML(p.rctx.Sanitize(htmlString))

     

       1188
       1188
       +
       			sanitized := p.rctx.SanitizeDefault(htmlString)

     

       1189
       1189
       +
       			params.RenderedContents = template.HTML(sanitized)

     

       1188
       1190
        
       		}

     

       1189
       1191
        
       	}

     

       1190
       1192