7e385fc126
Some checks failed
SonarQube / SonarQube (push) Failing after 5m28s
E2e test on main branch push / server and client test (map[name:admin port:8080]) (push) Failing after 3m33s
Server and lib tests / Library test (js) (push) Failing after 1m36s
Server and lib tests / Library test (vue) (push) Successful in 2m24s
Server and lib tests / Web client test (admin) (push) Successful in 2m52s
Server and lib tests / Web client test (compose) (push) Successful in 3m23s
Server and lib tests / Web client test (discovery) (push) Successful in 2m49s
Server and lib tests / Web client test (one) (push) Successful in 2m52s
Server and lib tests / Web client test (privacy) (push) Successful in 2m44s
Server and lib tests / Web client test (reporter) (push) Successful in 2m56s
Server and lib tests / Web client test (workflow) (push) Successful in 3m0s
Server and lib tests / Server tests (push) Failing after 4m55s
E2e test on main branch push / notify-failure (push) Failing after 9s
Server and lib tests / Send matrix testing notification (push) Successful in 2s
Mark stale issues and pull requests / stale (push) Successful in 40s
64 lines
2.6 KiB
Go
64 lines
2.6 KiB
Go
package xss
|
|
|
|
import (
|
|
"html"
|
|
"regexp"
|
|
|
|
"github.com/microcosm-cc/bluemonday"
|
|
)
|
|
|
|
var (
|
|
p *bluemonday.Policy
|
|
)
|
|
|
|
func init() {
|
|
// use standard html escaping policy
|
|
p = bluemonday.UGCPolicy()
|
|
|
|
// match only colors for html editor elements on style attr
|
|
p.AllowAttrs("style").OnElements("span", "p")
|
|
// Support both hex colors (#ff0000, #f00) and RGB colors (rgb(255, 0, 0))
|
|
hexPattern := regexp.MustCompile(`(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$`)
|
|
rgbPattern := regexp.MustCompile(`(?i)^rgb\(\s*\d+\s*,\s*\d+\s*,\s*\d+\s*\)$`)
|
|
p.AllowStyles("color").Matching(hexPattern).Globally()
|
|
p.AllowStyles("color").Matching(rgbPattern).Globally()
|
|
p.AllowStyles("background-color").Matching(hexPattern).Globally()
|
|
p.AllowStyles("background-color").Matching(rgbPattern).Globally()
|
|
|
|
// allow text alignment
|
|
p.AllowStyles("text-align").Matching(regexp.MustCompile("^(left|center|right|justify)$")).OnElements("span", "p", "h1", "h2", "h3", "h4", "h5", "h6", "h7")
|
|
|
|
// allow task lists (TipTap format)
|
|
p.AllowAttrs("data-type").Matching(regexp.MustCompile(`^(taskList|taskItem|mention)$`)).OnElements("ul", "li", "span")
|
|
p.AllowAttrs("data-checked").Matching(regexp.MustCompile(`^(true|false)$`)).OnElements("li")
|
|
p.AllowAttrs("checked").OnElements("input")
|
|
p.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
|
|
p.AllowAttrs("aria-label").OnElements("input")
|
|
p.AllowAttrs("contenteditable").Matching(regexp.MustCompile(`^(true|false)$`)).OnElements("span", "div", "label")
|
|
p.AllowAttrs("class").Matching(regexp.MustCompile(`^(todo-checkbox|todo-content|ProseMirror-trailingBreak|mention|ProseMirror-selectednode|ProseMirror-gapcursor)$`)).OnElements("span", "div", "label")
|
|
|
|
// allow mention attributes
|
|
p.AllowAttrs("data-id").Matching(regexp.MustCompile(`^\d+$`)).OnElements("span")
|
|
p.AllowAttrs("data-label").OnElements("span")
|
|
p.AllowAttrs("data-mention-suggestion-char").Matching(regexp.MustCompile(`^@$`)).OnElements("span")
|
|
|
|
// allow table attributes (TableKit extension)
|
|
p.AllowAttrs("colspan").Matching(regexp.MustCompile(`^\d+$`)).OnElements("td", "th")
|
|
p.AllowAttrs("rowspan").Matching(regexp.MustCompile(`^\d+$`)).OnElements("td", "th")
|
|
p.AllowAttrs("scope").Matching(regexp.MustCompile(`^(col|row|colgroup|rowgroup)$`)).OnElements("th")
|
|
|
|
// some link specifics we need; allow target but assure safety
|
|
p.AllowAttrs("target").OnElements("a")
|
|
p.AddTargetBlankToFullyQualifiedLinks(false)
|
|
}
|
|
|
|
// RichText assures safe HTML content
|
|
func RichText(in string) string {
|
|
sanitized := p.Sanitize(in)
|
|
|
|
// handle escaped strings and unescape them
|
|
// all the dangerous chars should have been stripped
|
|
// by now
|
|
return html.UnescapeString(sanitized)
|
|
}
|