USEFULL
/
gogs
mirror of https://github.com/gogs/gogs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

api: sanitize raw markdown content (#5907) 

Fixed a security issue reported by bluebird.
pull/5908/head
ᴜɴᴋɴᴡᴏɴ 2020-01-27 00:18:46 +08:00 committed by GitHub
parent 0a461b829a
commit 5e6c3b9d0e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
internal/markup/markdown.go
View File

@ -157,8 +157,7 @@ func RawMarkdown(body []byte, urlPrefix string) []byte {
extensions |= blackfriday.EXTENSION_HARD_LINE_BREAK extensions |= blackfriday.EXTENSION_HARD_LINE_BREAK
} }
body = blackfriday.Markdown(body, renderer, extensions) return blackfriday.Markdown(body, renderer, extensions)
return body
} }
// Markdown takes a string or []byte and renders to HTML in Markdown syntax with special links. // Markdown takes a string or []byte and renders to HTML in Markdown syntax with special links.

2
internal/markup/markup.go
View File

@ -334,7 +334,7 @@ func Detect(filename string) Type {
} }
} }
// Render takes a string or []byte and renders to HTML in given type of syntax with special links. // Render takes a string or []byte and renders to sanitized HTML in given type of syntax with special links.
func Render(typ Type, input interface{}, urlPrefix string, metas map[string]string) []byte { func Render(typ Type, input interface{}, urlPrefix string, metas map[string]string) []byte {
var rawBytes []byte var rawBytes []byte
switch v := input.(type) { switch v := input.(type) {

10
internal/route/api/v1/misc/markdown.go
View File

@ -20,16 +20,18 @@ func Markdown(c *context.APIContext, form api.MarkdownOption) {
} }
if len(form.Text) == 0 { if len(form.Text) == 0 {
c.Write([]byte("")) _, _ = c.Write([]byte(""))
return return
} }
var md []byte
switch form.Mode { switch form.Mode {
case "gfm": case "gfm":
c.Write(markup.Markdown([]byte(form.Text), form.Context, nil)) md = markup.Markdown([]byte(form.Text), form.Context, nil)
default: default:
c.Write(markup.RawMarkdown([]byte(form.Text), "")) md = markup.SanitizeBytes(markup.RawMarkdown([]byte(form.Text), ""))
} }
_, _ = c.Write(md)
} }
func MarkdownRaw(c *context.APIContext) { func MarkdownRaw(c *context.APIContext) {
@ -38,5 +40,5 @@ func MarkdownRaw(c *context.APIContext) {
c.Error(http.StatusUnprocessableEntity, "", err) c.Error(http.StatusUnprocessableEntity, "", err)
return return
} }
c.Write(markup.RawMarkdown(body, "")) _, _ = c.Write(markup.SanitizeBytes(markup.RawMarkdown(body, "")))
} }