From 9346b5702175daccb03627609ff0148912ca2a60 Mon Sep 17 00:00:00 2001
From: Denis Arh <denis.arh@gmail.com>
Date: Fri, 15 Apr 2022 17:03:58 +0200
Subject: [PATCH] Optimize HTML sanitization (pkg/xss) profile loading (mem
 leaking)

---
 pkg/xss/rich_text.go | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkg/xss/rich_text.go b/pkg/xss/rich_text.go
index 8c52088ef..63b942cd3 100644
--- a/pkg/xss/rich_text.go
+++ b/pkg/xss/rich_text.go
@@ -7,10 +7,13 @@ import (
 	"github.com/microcosm-cc/bluemonday"
 )
 
-// RichText assures safe HTML content
-func RichText(in string) string {
+var (
+	p *bluemonday.Policy
+)
+
+func init() {
 	// use standard html escaping policy
-	p := bluemonday.UGCPolicy()
+	p = bluemonday.UGCPolicy()
 
 	// match only colors for html editor elements on style attr
 	p.AllowAttrs("style").OnElements("span", "p")
@@ -30,7 +33,10 @@ func RichText(in string) string {
 	// some link specifics we need; allow target but assure safety
 	p.AllowAttrs("target").OnElements("a")
 	p.AddTargetBlankToFullyQualifiedLinks(false)
+}
 
+// RichText assures safe HTML content
+func RichText(in string) string {
 	sanitized := p.Sanitize(in)
 
 	// handle escaped strings and unescape them