From 3a9fd81f5946cbd70390b9c061bdcd1842f29735 Mon Sep 17 00:00:00 2001
From: "Kim \"BKC\" Carlbäcker" <kim.carlbacker@gmail.com>
Date: Thu, 14 Jan 2016 07:20:03 +0100
Subject: Custom URL-Schemas for Markdown

---
 modules/base/markdown.go | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

(limited to 'modules/base/markdown.go')

diff --git a/modules/base/markdown.go b/modules/base/markdown.go
index 0ef379b8ed..62db945a53 100644
--- a/modules/base/markdown.go
+++ b/modules/base/markdown.go
@@ -29,16 +29,10 @@ func isalnum(c byte) bool {
 	return (c >= '0' && c <= '9') || isletter(c)
 }
 
-var validLinks = [][]byte{[]byte("http://"), []byte("https://"), []byte("ftp://"), []byte("mailto://")}
+var validLinksPattern = regexp.MustCompile(`^[a-z][\w-]+://`)
 
 func isLink(link []byte) bool {
-	for _, prefix := range validLinks {
-		if len(link) > len(prefix) && bytes.Equal(bytes.ToLower(link[:len(prefix)]), prefix) && isalnum(link[len(prefix)]) {
-			return true
-		}
-	}
-
-	return false
+	return validLinksPattern.Match(link)
 }
 
 func IsMarkdownFile(name string) bool {
@@ -346,7 +340,7 @@ OUTER_LOOP:
 func RenderMarkdown(rawBytes []byte, urlPrefix string, metas map[string]string) []byte {
 	result := RenderRawMarkdown(rawBytes, urlPrefix)
 	result = PostProcessMarkdown(result, urlPrefix, metas)
-	result = Sanitizer.SanitizeBytes(result)
+	result = BuildSanitizer().SanitizeBytes(result)
 	return result
 }
 
-- 
cgit v1.2.3


From 1ab8a60d737b278c176d0b6204843a79dab0e878 Mon Sep 17 00:00:00 2001
From: "Kim \"BKC\" Carlbäcker" <kim.carlbacker@gmail.com>
Date: Wed, 27 Jan 2016 21:48:57 +0100
Subject: Not working, but slightly better...

---
 modules/base/markdown.go     |  2 +-
 modules/base/tool.go         | 22 ++++++++++++----------
 modules/template/template.go |  2 +-
 routers/install.go           |  3 +++
 4 files changed, 17 insertions(+), 12 deletions(-)

(limited to 'modules/base/markdown.go')

diff --git a/modules/base/markdown.go b/modules/base/markdown.go
index 62db945a53..05ee5f4a51 100644
--- a/modules/base/markdown.go
+++ b/modules/base/markdown.go
@@ -340,7 +340,7 @@ OUTER_LOOP:
 func RenderMarkdown(rawBytes []byte, urlPrefix string, metas map[string]string) []byte {
 	result := RenderRawMarkdown(rawBytes, urlPrefix)
 	result = PostProcessMarkdown(result, urlPrefix, metas)
-	result = BuildSanitizer().SanitizeBytes(result)
+	result = Sanitizer.SanitizeBytes(result)
 	return result
 }
 
diff --git a/modules/base/tool.go b/modules/base/tool.go
index 5280fef203..ad39db892c 100644
--- a/modules/base/tool.go
+++ b/modules/base/tool.go
@@ -31,17 +31,19 @@ import (
 	"github.com/gogits/gogs/modules/setting"
 )
 
-func BuildSanitizer() (p *bluemonday.Policy) {
-	p = bluemonday.UGCPolicy()
-	p.AllowAttrs("class").Matching(regexp.MustCompile(`[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&]*`)).OnElements("code")
-
-	p.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
-	p.AllowAttrs("checked", "disabled").OnElements("input")
-	p.AllowURLSchemes(setting.Markdown.CustomURLSchemes...)
-	return p
-}
+var Sanitizer = bluemonday.UGCPolicy()
+
+func BuildSanitizer() {
+	// Normal markdown-stuff
+	Sanitizer.AllowAttrs("class").Matching(regexp.MustCompile(`[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&]*`)).OnElements("code")
 
-var Sanitizer = BuildSanitizer()
+	// Checkboxes
+	Sanitizer.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
+	Sanitizer.AllowAttrs("checked", "disabled").OnElements("input")
+
+	// Custom URL-Schemes
+	Sanitizer.AllowURLSchemes(setting.Markdown.CustomURLSchemes...)
+}
 
 // EncodeMD5 encodes string to md5 hex value.
 func EncodeMD5(str string) string {
diff --git a/modules/template/template.go b/modules/template/template.go
index d95035c352..6099fcc987 100644
--- a/modules/template/template.go
+++ b/modules/template/template.go
@@ -105,7 +105,7 @@ func Safe(raw string) template.HTML {
 }
 
 func Str2html(raw string) template.HTML {
-	return template.HTML(base.BuildSanitizer().Sanitize(raw))
+	return template.HTML(base.Sanitizer.Sanitize(raw))
 }
 
 func Range(l int) []int {
diff --git a/routers/install.go b/routers/install.go
index 120aa46851..b311355bf8 100644
--- a/routers/install.go
+++ b/routers/install.go
@@ -91,6 +91,9 @@ func GlobalInit() {
 		ssh.Listen(setting.SSHPort)
 		log.Info("SSH server started on :%v", setting.SSHPort)
 	}
+
+	// Build Sanitizer
+	base.BuildSanitizer()
 }
 
 func InstallInit(ctx *middleware.Context) {
-- 
cgit v1.2.3