gogs/internal/app/api.go
ᴜɴᴋɴᴡᴏɴ a43fc9ad17
ipynb: sanitize rendered HTML (#5996)
* ipynb: sanitize rendered HTML

Fixes #5170

* Remove hardcode URL

* Add tests
2020-03-21 00:12:38 +08:00

37 lines
760 B
Go

// Copyright 2020 The Gogs Authors. All rights reserved.
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
package app
import (
"net/http"
"github.com/microcosm-cc/bluemonday"
"gopkg.in/macaron.v1"
"gogs.io/gogs/internal/context"
)
func ipynbSanitizer() *bluemonday.Policy {
p := bluemonday.UGCPolicy()
p.AllowAttrs("class", "data-prompt-number").OnElements("div")
p.AllowAttrs("class").OnElements("img")
p.AllowURLSchemes("data")
return p
}
func SanitizeIpynb() macaron.Handler {
p := ipynbSanitizer()
return func(c *context.Context) {
html, err := c.Req.Body().String()
if err != nil {
c.Error(err, "read body")
return
}
c.PlainText(http.StatusOK, p.Sanitize(html))
}
}