diff options
| author | wxiaoguang <wxiaoguang@gmail.com> | 2024-03-04 20:02:45 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-03-04 12:02:45 +0000 |
| commit | dae7f1ebdbe19620f40e110b285f7c0ecd0bb33b (patch) | |
| tree | de769b87f498ff4e2ee87828adcc2ea5da8ae5e4 /modules | |
| parent | e91733468ef726fc9365aa4820cdd5f2ddfdaa23 (diff) | |
| download | gitea-dae7f1ebdbe19620f40e110b285f7c0ecd0bb33b.tar.gz gitea-dae7f1ebdbe19620f40e110b285f7c0ecd0bb33b.zip | |
Remove unnecessary SanitizeHTML from code (#29575)
* "mail/issue/default.tmpl": the body is rendered by backend
`markdown.RenderString() HTML`, it has been already sanitized
* "repo/settings/webhook/base_list.tmpl": "Description" is prepared by
backend `ctx.Tr`, it doesn't need to be sanitized
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/templates/helper.go | 10 | ||||
| -rw-r--r-- | modules/templates/helper_test.go | 1 |
2 files changed, 2 insertions, 9 deletions
diff --git a/modules/templates/helper.go b/modules/templates/helper.go index 1487fce69d..0997239a55 100644 --- a/modules/templates/helper.go +++ b/modules/templates/helper.go @@ -208,14 +208,8 @@ func SafeHTML(s any) template.HTML { } // SanitizeHTML sanitizes the input by pre-defined markdown rules -func SanitizeHTML(s any) template.HTML { - switch v := s.(type) { - case string: - return template.HTML(markup.Sanitize(v)) - case template.HTML: - return template.HTML(markup.Sanitize(string(v))) - } - panic(fmt.Sprintf("unexpected type %T", s)) +func SanitizeHTML(s string) template.HTML { + return template.HTML(markup.Sanitize(s)) } func HTMLEscape(s any) template.HTML { diff --git a/modules/templates/helper_test.go b/modules/templates/helper_test.go index 3365278ac2..64f29d033e 100644 --- a/modules/templates/helper_test.go +++ b/modules/templates/helper_test.go @@ -64,5 +64,4 @@ func TestHTMLFormat(t *testing.T) { func TestSanitizeHTML(t *testing.T) { assert.Equal(t, template.HTML(`<a href="/" rel="nofollow">link</a> xss <div>inline</div>`), SanitizeHTML(`<a href="/">link</a> <a href="javascript:">xss</a> <div style="dangerous">inline</div>`)) - assert.Equal(t, template.HTML(`<a href="/" rel="nofollow">link</a> xss <div>inline</div>`), SanitizeHTML(template.HTML(`<a href="/">link</a> <a href="javascript:">xss</a> <div style="dangerous">inline</div>`))) } |