LogalDeveloper/owncast
0
Fork 0
Code Activity

better chat message sanitization (#1266)

Browse Source 
* strip <p> in chat sanitization, keep the content

* update sanitization tests

* update tests

* rm <p></p> comparison for empty messages
This commit is contained in:
Meisam
2021-07-28 00:26:27 +02:00
committed by GitHub
parent 92284f6ca1
commit 109d2669ab
4 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/chat/events/events.go
View File

@@ -73,7 +73,7 @@ func (m *MessageEvent) RenderAndSanitizeMessageBody() {
// Empty will return if this message's contents is empty.
func (m *MessageEvent) Empty() bool {
return m.Body == "" || m.Body == "<p></p>"
return m.Body == ""
}
// RenderBody will render markdown to html without any sanitization.
@@ -136,7 +136,9 @@ func sanitize(raw string) string {
p.AddTargetBlankToFullyQualifiedLinks(true)
// Allow breaks
p.AllowElements("br", "p")
p.AllowElements("br")
p.AllowElementsContent("p")
// Allow img tags from the the local emoji directory only
p.AllowAttrs("src").Matching(regexp.MustCompile(`(?i)^/img/emoji`)).OnElements("img")