DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Add extra sanitization rules for RTE contents

Browse Source
This commit is contained in:
Tomaž Jerman
2022-03-24 10:10:37 +01:00
parent c0200345ac
commit be71872b56
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/xss/rich_text.go
View File

@@ -17,6 +17,16 @@ func RichText(in string) string {
p.AllowStyles("color").Matching(regexp.MustCompile("(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$")).Globally()
p.AllowStyles("background-color").Matching(regexp.MustCompile("(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$")).Globally()
// allow text alignment
p.AllowStyles("text-align").Matching(regexp.MustCompile("^(left|center|right|justify)$")).OnElements("span", "p")
// allow checklists
p.AllowAttrs("data-type").Matching(regexp.MustCompile("^(todo_list|todo_item)$")).OnElements("ul", "li")
p.AllowAttrs("data-done").Matching(regexp.MustCompile("^(true|false)$")).OnElements("ul", "li")
p.AllowAttrs("data-drag-handle").OnElements("li")
p.AllowAttrs("contenteditable").OnElements("span", "div")
p.AllowAttrs("class").Matching(regexp.MustCompile("^(todo-checkbox|todo-content)$"))
// some link specifics we need; allow target but assure safety
p.AllowAttrs("target").OnElements("a")
p.AddTargetBlankToFullyQualifiedLinks(false)