diff options
| author | Earl Warren <109468362+earl-warren@users.noreply.github.com> | 2023-11-23 17:34:25 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-11-23 16:34:25 +0000 |
| commit | 1075ff74b5050f671c5f9824ae39390230b3c85d (patch) | |
| tree | 341f0d13f5f804ed81f00cb8f3b023bab1eeb0dd /models | |
| parent | 7d1933717d5eff2011128084693d57308d8102a4 (diff) | |
| download | gitea-1075ff74b5050f671c5f9824ae39390230b3c85d.tar.gz gitea-1075ff74b5050f671c5f9824ae39390230b3c85d.zip | |
Use restricted sanitizer for repository description (#28141)
- Currently the repository description uses the same sanitizer as a
normal markdown document. This means that element such as heading and
images are allowed and can be abused.
- Create a minimal restricted sanitizer for the repository description,
which only allows what the postprocessor currently allows, which are
links and emojis.
- Added unit testing.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1202
- Resolves https://codeberg.org/Codeberg/Community/issues/1122
(cherry picked from commit 631c87cc2347f0036a75dcd21e24429bbca28207)
Co-authored-by: Gusted <postmaster@gusted.xyz>
Diffstat (limited to 'models')
| -rw-r--r-- | models/repo/repo.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/models/repo/repo.go b/models/repo/repo.go index c4b215e074..db3709f1e8 100644 --- a/models/repo/repo.go +++ b/models/repo/repo.go @@ -584,9 +584,9 @@ func (repo *Repository) DescriptionHTML(ctx context.Context) template.HTML { }, repo.Description) if err != nil { log.Error("Failed to render description for %s (ID: %d): %v", repo.Name, repo.ID, err) - return template.HTML(markup.Sanitize(repo.Description)) + return template.HTML(markup.SanitizeDescription(repo.Description)) } - return template.HTML(markup.Sanitize(desc)) + return template.HTML(markup.SanitizeDescription(desc)) } // CloneLink represents different types of clone URLs of repository. |