diff options
| author | wxiaoguang <wxiaoguang@gmail.com> | 2025-03-03 10:57:28 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-03-03 10:57:28 +0800 |
| commit | 27bf63ad20e3241d48636064f585a6d432bdcaa7 (patch) | |
| tree | ab18faca2e931374b628d9ff4c09aa9d151411ae /modules | |
| parent | 5cbdf83f706ecdace65e5b42897ebbde82c3a0a1 (diff) | |
| download | gitea-27bf63ad20e3241d48636064f585a6d432bdcaa7.tar.gz gitea-27bf63ad20e3241d48636064f585a6d432bdcaa7.zip | |
Refactor global init code and add more comments (#33755)
Follow up #33748
Now there are 3 "global" functions:
* registerGlobalSelectorFunc: for all elements matching the selector, eg: `.ui.dropdown`
* registerGlobalInitFunc: for `data-global-init="initInputAutoFocusEnd"`
* registerGlobalEventFunc: for `data-global-click="onCommentReactionButtonClick"`
And introduce `initGlobalInput` to replace old `initAutoFocusEnd` and
`attachDirAuto`, use `data-global-init` to replace fragile
`.js-autofocus-end` selector.
Another benefit is that by the new approach, no matter how many times
`registerGlobalInitFunc` is called, we only need to do one
"querySelectorAll" in the last step, it could slightly improve the
performance.
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/markup/sanitizer_default_test.go | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/modules/markup/sanitizer_default_test.go b/modules/markup/sanitizer_default_test.go index e6fbae5056..5282916944 100644 --- a/modules/markup/sanitizer_default_test.go +++ b/modules/markup/sanitizer_default_test.go @@ -62,6 +62,10 @@ func TestSanitizer(t *testing.T) { `<a href="javascript:alert('xss')">bad</a>`, `bad`, `<a href="vbscript:no">bad</a>`, `bad`, `<a href="data:1234">bad</a>`, `bad`, + + // Some classes and attributes are used by the frontend framework and will execute JS code, so make sure they are removed + `<div class="link-action" data-attr-class="foo" data-url="xxx">txt</div>`, `<div data-attr-class="foo">txt</div>`, + `<div class="form-fetch-action" data-markdown-generated-content="bar" data-global-init="a" data-global-click="b">txt</div>`, `<div data-markdown-generated-content="bar">txt</div>`, } for i := 0; i < len(testCases); i += 2 { |