diff options
| author | Yarden Shoham <git@yardenshoham.com> | 2023-05-19 18:17:07 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-05-19 17:17:07 +0200 |
| commit | f5ce2ed292a90041abd749a8db26671645648a43 (patch) | |
| tree | 22e5223563b637f4a3fb9fdefb5cdae37d7e6eb3 /modules/markup/sanitizer.go | |
| parent | 38cf43d0606c13c38f459659f38e26cf31dceccb (diff) | |
| download | gitea-f5ce2ed292a90041abd749a8db26671645648a43.tar.gz gitea-f5ce2ed292a90041abd749a8db26671645648a43.zip | |
Allow all URL schemes in Markdown links by default (#24805)
- Closes #21146
- Closes #16721
## :warning: BREAKING :warning:
This changes the default behavior to now create links for any URL scheme
when the user uses the markdown form for links (`[label](URL)`), this
doesn't affect the rendering of inline links. To opt-out set the
`markdown.CUSTOM_URL_SCHEMES` setting to a list of allowed schemes, all
other schemes (except `http` and `https`) won't be allowed.
# Before
# After
---------
Signed-off-by: Yarden Shoham <git@yardenshoham.com>
Co-authored-by: Giteabot <teabot@gitea.io>
Diffstat (limited to 'modules/markup/sanitizer.go')
| -rw-r--r-- | modules/markup/sanitizer.go | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/modules/markup/sanitizer.go b/modules/markup/sanitizer.go index 600ccbf3c6..a0c9ee171f 100644 --- a/modules/markup/sanitizer.go +++ b/modules/markup/sanitizer.go @@ -22,7 +22,10 @@ type Sanitizer struct { init sync.Once } -var sanitizer = &Sanitizer{} +var ( + sanitizer = &Sanitizer{} + allowAllRegex = regexp.MustCompile(".+") +) // NewSanitizer initializes sanitizer with allowed attributes based on settings. // Multiple calls to this function will only create one instance of Sanitizer during @@ -74,6 +77,8 @@ func createDefaultPolicy() *bluemonday.Policy { // Custom URL-Schemes if len(setting.Markdown.CustomURLSchemes) > 0 { policy.AllowURLSchemes(setting.Markdown.CustomURLSchemes...) + } else { + policy.AllowURLSchemesMatching(allowAllRegex) } // Allow classes for anchors |