- Notifications
You must be signed in to change notification settings - Fork3k
Add html filtering#1356
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Add html filtering#1356
Changes fromall commits
062c13ad2d09b7ae62cc9c01b5d0058c0f35b4fcd69e8d209File filter
Filter by extension
Conversations
Uh oh!
There was an error while loading.Please reload this page.
Jump to
Uh oh!
There was an error while loading.Please reload this page.
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,18 @@ | ||
| package sanitize | ||
| import ( | ||
| "sync" | ||
| "github.com/microcosm-cc/bluemonday" | ||
| ) | ||
| varpolicy*bluemonday.Policy | ||
| varpolicyOnce sync.Once | ||
| funcSanitize(inputstring)string { | ||
| returnFilterHTMLTags(FilterInvisibleCharacters(input)) | ||
| } | ||
| // FilterInvisibleCharacters removes invisible or control characters that should not appear | ||
| // in user-facing titles or bodies. This includes: | ||
| // - Unicode tag characters: U+E0001, U+E0020–U+E007F | ||
| @@ -20,6 +33,41 @@ func FilterInvisibleCharacters(input string) string { | ||
| returnstring(out) | ||
| } | ||
| funcFilterHTMLTags(inputstring)string { | ||
| ifinput=="" { | ||
Contributor There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others.Learn more. Maybe we could also check if the string has any HTML in the first place in this early return? Collaborator There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others.Learn more. Interesting idea, although an early return that has to parse the content might not be an optimisation. Hard to tell without getting into the weeds. Contributor There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others.Learn more. What I was mainly thinking about is just adding a simple ContributorAuthor There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others.Learn more. Bluemonday does html input tokenization and I don't want to reinvent the wheel here. :) | ||
| returninput | ||
| } | ||
| returngetPolicy().Sanitize(input) | ||
| } | ||
| funcgetPolicy()*bluemonday.Policy { | ||
| policyOnce.Do(func() { | ||
| p:=bluemonday.StrictPolicy() | ||
| p.AllowElements( | ||
| "b","blockquote","br","code","em", | ||
| "h1","h2","h3","h4","h5","h6", | ||
| "hr","i","li","ol","p","pre", | ||
| "strong","sub","sup","table","tbody", | ||
| "td","th","thead","tr","ul", | ||
| "a","img", | ||
| ) | ||
| p.AllowAttrs("href").OnElements("a") | ||
| p.AllowURLSchemes("https") | ||
JoannaaKL marked this conversation as resolved. Show resolvedHide resolvedUh oh!There was an error while loading.Please reload this page. | ||
| p.RequireParseableURLs(true) | ||
| p.RequireNoFollowOnLinks(true) | ||
| p.RequireNoReferrerOnLinks(true) | ||
| p.AddTargetBlankToFullyQualifiedLinks(true) | ||
| p.AllowImages() | ||
| p.AllowAttrs("src","alt","title").OnElements("img") | ||
| policy=p | ||
| }) | ||
| returnpolicy | ||
| } | ||
| funcshouldRemoveRune(rrune)bool { | ||
| switchr { | ||
| case0x200B,// ZERO WIDTH SPACE | ||
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.