Not working, but slightly better...

release/v1.15
Kim "BKC" Carlbäcker 2016-01-27 21:48:57 +01:00
parent d943429672
commit 1ab8a60d73
4 changed files with 16 additions and 11 deletions

View File

@ -340,7 +340,7 @@ OUTER_LOOP:
func RenderMarkdown(rawBytes []byte, urlPrefix string, metas map[string]string) []byte {
result := RenderRawMarkdown(rawBytes, urlPrefix)
result = PostProcessMarkdown(result, urlPrefix, metas)
result = BuildSanitizer().SanitizeBytes(result)
result = Sanitizer.SanitizeBytes(result)
return result
}

View File

@ -31,18 +31,20 @@ import (
"github.com/gogits/gogs/modules/setting"
)
func BuildSanitizer() (p *bluemonday.Policy) {
p = bluemonday.UGCPolicy()
p.AllowAttrs("class").Matching(regexp.MustCompile(`[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&]*`)).OnElements("code")
var Sanitizer = bluemonday.UGCPolicy()
p.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
p.AllowAttrs("checked", "disabled").OnElements("input")
p.AllowURLSchemes(setting.Markdown.CustomURLSchemes...)
return p
func BuildSanitizer() {
// Normal markdown-stuff
Sanitizer.AllowAttrs("class").Matching(regexp.MustCompile(`[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&]*`)).OnElements("code")
// Checkboxes
Sanitizer.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
Sanitizer.AllowAttrs("checked", "disabled").OnElements("input")
// Custom URL-Schemes
Sanitizer.AllowURLSchemes(setting.Markdown.CustomURLSchemes...)
}
var Sanitizer = BuildSanitizer()
// EncodeMD5 encodes string to md5 hex value.
func EncodeMD5(str string) string {
m := md5.New()

View File

@ -105,7 +105,7 @@ func Safe(raw string) template.HTML {
}
func Str2html(raw string) template.HTML {
return template.HTML(base.BuildSanitizer().Sanitize(raw))
return template.HTML(base.Sanitizer.Sanitize(raw))
}
func Range(l int) []int {

View File

@ -91,6 +91,9 @@ func GlobalInit() {
ssh.Listen(setting.SSHPort)
log.Info("SSH server started on :%v", setting.SSHPort)
}
// Build Sanitizer
base.BuildSanitizer()
}
func InstallInit(ctx *middleware.Context) {