-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: XSS issues in page descriptions (#307)
- Loading branch information
Showing
6 changed files
with
31 additions
and
70 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,62 +1,15 @@ | ||
| package utils | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "strings" | ||
| "unicode" | ||
|
|
||
| "golang.org/x/net/html" | ||
| "github.com/microcosm-cc/bluemonday" | ||
| ) | ||
|
|
||
| // This is non-exhaustive, but captures most required nodes | ||
| const stripAllowedNodes = "html body p a strong em span section div" | ||
|
|
||
| // StripHTML strips HTML tags from a string, extracting all plain text. | ||
| func StripHTML(htmls string) (string, error) { | ||
| doc, err := html.Parse(strings.NewReader(htmls)) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| var buffer bytes.Buffer | ||
| anodes := strings.Split(stripAllowedNodes, " ") | ||
|
|
||
| var f func(n *html.Node) | ||
| f = func(n *html.Node) { | ||
| switch n.Type { | ||
| case html.DocumentNode: | ||
| if n.FirstChild != nil { | ||
| f(n.FirstChild) | ||
| } | ||
| case html.ElementNode: | ||
| // Decide whether to descend into the element's | ||
| // children | ||
| allowed := false | ||
| for _, anode := range anodes { | ||
| if n.Data == anode { | ||
| allowed = true | ||
| break | ||
| } | ||
| } | ||
| func StripHTML(htmls string) string { | ||
| sanitizer := bluemonday.StrictPolicy() | ||
|
|
||
| if allowed && n.FirstChild != nil { | ||
| f(n.FirstChild) | ||
| } | ||
| return sanitizer.Sanitize(htmls) | ||
|
|
||
| // Ensure whitespace between paragraphs (hack!) | ||
| if n.Data == "p" { | ||
| buffer.WriteString("\n\n") | ||
| } | ||
| case html.TextNode: | ||
| buffer.WriteString(n.Data) | ||
| } | ||
|
|
||
| if n.NextSibling != nil { | ||
| f(n.NextSibling) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| f(doc) | ||
|
|
||
| return strings.TrimFunc(buffer.String(), unicode.IsSpace), nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters