Nemcio/Gogs
1
0
Fork 0
mirror of https://github.com/gogs/gogs.git synced 2025-12-20 15:20:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

markdown: improve filter of class attribute for code blocks

Browse Source 
Only allow HighlightJS specific classes.

Reported by ChALkeR.
This commit is contained in:
Unknwon
2017-03-29 19:52:53 -04:00
parent 09723ec0e5
commit 9d06ebd01a
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
modules/markdown/markdown.go
View File

@@ -32,8 +32,8 @@ var Sanitizer = bluemonday.UGCPolicy()
// BuildSanitizer initializes sanitizer with allowed attributes based on settings.
// This function should only be called once during entire application lifecycle.
func BuildSanitizer() {
// Normal markdown-stuff
Sanitizer.AllowAttrs("class").Matching(regexp.MustCompile(`[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&]*`)).OnElements("code")
// We only want to allow HighlightJS specific classes for code blocks
Sanitizer.AllowAttrs("class").Matching(regexp.MustCompile(`^language-\w+`)).OnElements("code")
// Checkboxes
Sanitizer.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")