diff options
| author | zeripath <art27@cantab.net> | 2020-05-03 21:17:24 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-05-03 17:17:24 -0300 |
| commit | ce66ca7f9f20ee69739e8800a4a629abbe9d25ac (patch) | |
| tree | e634913f0abbf0aa54910ea79d09e2543df82cd5 /modules/markup/sanitizer.go | |
| parent | 940ed923920ae662efa6967679e60297832c4af8 (diff) | |
| download | gitea-ce66ca7f9f20ee69739e8800a4a629abbe9d25ac.tar.gz gitea-ce66ca7f9f20ee69739e8800a4a629abbe9d25ac.zip | |
Restore checkbox rendering and prevent poor sanitization of spans (#11277)
* Add test
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Restore checkbox rendering and prevent poor sanitization of spans
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Also fix preview context
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Also fix preview context
Signed-off-by: Andrew Thornton <art27@cantab.net>
Diffstat (limited to 'modules/markup/sanitizer.go')
| -rw-r--r-- | modules/markup/sanitizer.go | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/modules/markup/sanitizer.go b/modules/markup/sanitizer.go index faf4163109..39e4a93dd3 100644 --- a/modules/markup/sanitizer.go +++ b/modules/markup/sanitizer.go @@ -58,15 +58,16 @@ func ReplaceSanitizer() { // Allow icons sanitizer.policy.AllowAttrs("class").Matching(regexp.MustCompile(`^icon(\s+[\p{L}\p{N}_-]+)+$`)).OnElements("i") - sanitizer.policy.AllowAttrs("class").Matching(regexp.MustCompile(`^((icon(\s+[\p{L}\p{N}_-]+)+)|(ui checkbox)|(ui checked checkbox))$`)).OnElements("span") // Allow unlabelled labels sanitizer.policy.AllowNoAttrs().OnElements("label") // Allow classes for emojis - sanitizer.policy.AllowAttrs("class").Matching(regexp.MustCompile(`emoji`)).OnElements("span") sanitizer.policy.AllowAttrs("class").Matching(regexp.MustCompile(`emoji`)).OnElements("img") + // Allow icons, checkboxes and emojis on span + sanitizer.policy.AllowAttrs("class").Matching(regexp.MustCompile(`^((icon(\s+[\p{L}\p{N}_-]+)+)|(ui checkbox)|(ui checked checkbox)|(emoji))$`)).OnElements("span") + // Allow generally safe attributes generalSafeAttrs := []string{"abbr", "accept", "accept-charset", "accesskey", "action", "align", "alt", |