snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/pkg/xss/rich_text.go

@@ -0,0 +1,63 @@
+package xss
+
+import (
+	"html"
+	"regexp"
+
+	"github.com/microcosm-cc/bluemonday"
+)
+
+var (
+	p *bluemonday.Policy
+)
+
+func init() {
+	// use standard html escaping policy
+	p = bluemonday.UGCPolicy()
+
+	// match only colors for html editor elements on style attr
+	p.AllowAttrs("style").OnElements("span", "p")
+	// Support both hex colors (#ff0000, #f00) and RGB colors (rgb(255, 0, 0))
+	hexPattern := regexp.MustCompile(`(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$`)
+	rgbPattern := regexp.MustCompile(`(?i)^rgb\(\s*\d+\s*,\s*\d+\s*,\s*\d+\s*\)$`)
+	p.AllowStyles("color").Matching(hexPattern).Globally()
+	p.AllowStyles("color").Matching(rgbPattern).Globally()
+	p.AllowStyles("background-color").Matching(hexPattern).Globally()
+	p.AllowStyles("background-color").Matching(rgbPattern).Globally()
+
+	// allow text alignment
+	p.AllowStyles("text-align").Matching(regexp.MustCompile("^(left|center|right|justify)$")).OnElements("span", "p", "h1", "h2", "h3", "h4", "h5", "h6", "h7")
+
+	// allow task lists (TipTap format)
+	p.AllowAttrs("data-type").Matching(regexp.MustCompile(`^(taskList|taskItem|mention)$`)).OnElements("ul", "li", "span")
+	p.AllowAttrs("data-checked").Matching(regexp.MustCompile(`^(true|false)$`)).OnElements("li")
+	p.AllowAttrs("checked").OnElements("input")
+	p.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
+	p.AllowAttrs("aria-label").OnElements("input")
+	p.AllowAttrs("contenteditable").Matching(regexp.MustCompile(`^(true|false)$`)).OnElements("span", "div", "label")
+	p.AllowAttrs("class").Matching(regexp.MustCompile(`^(todo-checkbox|todo-content|ProseMirror-trailingBreak|mention|ProseMirror-selectednode|ProseMirror-gapcursor)$`)).OnElements("span", "div", "label")
+
+	// allow mention attributes
+	p.AllowAttrs("data-id").Matching(regexp.MustCompile(`^\d+$`)).OnElements("span")
+	p.AllowAttrs("data-label").OnElements("span")
+	p.AllowAttrs("data-mention-suggestion-char").Matching(regexp.MustCompile(`^@$`)).OnElements("span")
+
+	// allow table attributes (TableKit extension)
+	p.AllowAttrs("colspan").Matching(regexp.MustCompile(`^\d+$`)).OnElements("td", "th")
+	p.AllowAttrs("rowspan").Matching(regexp.MustCompile(`^\d+$`)).OnElements("td", "th")
+	p.AllowAttrs("scope").Matching(regexp.MustCompile(`^(col|row|colgroup|rowgroup)$`)).OnElements("th")
+
+	// some link specifics we need; allow target but assure safety
+	p.AllowAttrs("target").OnElements("a")
+	p.AddTargetBlankToFullyQualifiedLinks(false)
+}
+
+// RichText assures safe HTML content
+func RichText(in string) string {
+	sanitized := p.Sanitize(in)
+
+	// handle escaped strings and unescape them
+	// all the dangerous chars should have been stripped
+	// by now
+	return html.UnescapeString(sanitized)
+}