domi/forgejo-domi
1
0
Fork 0
forked from forgejo/forgejo
Code Pull requests Activity

Upgrade Bluemonday to v1.0.16 (#17372)

Browse source 
Upgrade Bluemonday to latest version

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: 6543 <6543@obermui.de>
This commit is contained in:
zeripath 2021-10-20 21:58:39 +01:00 • committed by GitHub
parent 35b918f574
commit c5a408df05
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
14 changed files with 103 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

57
vendor/github.com/microcosm-cc/bluemonday/sanitize.go generated vendored
View file

@ -130,7 +130,7 @@ func escapeUrlComponent(w stringWriterWriter, val string) error {
return err
}
// Query represents a single part of the query string, a query param
// Query represents a single part of the query string, a query param
type Query struct {
Key string
Value string
@ -293,6 +293,17 @@ func (p *Policy) sanitize(r io.Reader, w io.Writer) error {
mostRecentlyStartedToken = normaliseElementName(token.Data)
switch normaliseElementName(token.Data) {
case `script`:
if !p.allowUnsafe {
continue
}
case `style`:
if !p.allowUnsafe {
continue
}
}
aps, ok := p.elsAndAttrs[token.Data]
if !ok {
aa, matched := p.matchRegex(token.Data)
@ -341,6 +352,17 @@ func (p *Policy) sanitize(r io.Reader, w io.Writer) error {
mostRecentlyStartedToken = ""
}
switch normaliseElementName(token.Data) {
case `script`:
if !p.allowUnsafe {
continue
}
case `style`:
if !p.allowUnsafe {
continue
}
}
if skipClosingTag && closingTagToSkipStack[len(closingTagToSkipStack)-1] == token.Data {
closingTagToSkipStack = closingTagToSkipStack[:len(closingTagToSkipStack)-1]
if len(closingTagToSkipStack) == 0 {
@ -386,6 +408,17 @@ func (p *Policy) sanitize(r io.Reader, w io.Writer) error {
case html.SelfClosingTagToken:
switch normaliseElementName(token.Data) {
case `script`:
if !p.allowUnsafe {
continue
}
case `style`:
if !p.allowUnsafe {
continue
}
}
aps, ok := p.elsAndAttrs[token.Data]
if !ok {
aa, matched := p.matchRegex(token.Data)
@ -425,14 +458,22 @@ func (p *Policy) sanitize(r io.Reader, w io.Writer) error {
case `script`:
// not encouraged, but if a policy allows JavaScript we
// should not HTML escape it as that would break the output
if _, err := buff.WriteString(token.Data); err != nil {
return err
//
// requires p.AllowUnsafe()
if p.allowUnsafe {
if _, err := buff.WriteString(token.Data); err != nil {
return err
}
}
case "style":
// not encouraged, but if a policy allows CSS styles we
// should not HTML escape it as that would break the output
if _, err := buff.WriteString(token.Data); err != nil {
return err
//
// requires p.AllowUnsafe()
if p.allowUnsafe {
if _, err := buff.WriteString(token.Data); err != nil {
return err
}
}
default:
// HTML escape the text
@ -524,11 +565,11 @@ attrsLoop:
for _, ap := range apl {
if ap.regexp != nil {
if ap.regexp.MatchString(htmlAttr.Val) {
htmlAttr.Val = escapeAttribute(htmlAttr.Val)
htmlAttr.Val = escapeAttribute(htmlAttr.Val)
cleanAttrs = append(cleanAttrs, htmlAttr)
}
} else {
htmlAttr.Val = escapeAttribute(htmlAttr.Val)
htmlAttr.Val = escapeAttribute(htmlAttr.Val)
cleanAttrs = append(cleanAttrs, htmlAttr)
}
}
@ -1058,4 +1099,4 @@ func escapeAttribute(val string) string {
val = strings.Replace(val, string([]rune{'\u00A0'}), `&nbsp;`, -1)
val = strings.Replace(val, `"`, `&quot;`, -1)
return val
}
}