diff options
| author |  Tobi Smethurst <31960611+tsmethurst@users.noreply.github.com> | 2021-07-13 16:03:51 +0200 |
|---|---|---|
| committer |  GitHub <noreply@github.com> | 2021-07-13 16:03:51 +0200 |
| commit | bdba3ff9a9f98c1605c01c0e84f6bd6ed5c3efae (patch) | |
| tree | faf0be2250d23aec1af6a6d2bcf321d1d8826ba9 /internal/processing/status/util.go | |
| parent | Block/unblock (#96) (diff) | |
| download | gotosocial-bdba3ff9a9f98c1605c01c0e84f6bd6ed5c3efae.tar.xz | |
sanitize html for statuses + instance (#97)
* sanitize html for statuses + instance
* sanitization
Diffstat (limited to 'internal/processing/status/util.go')
| -rw-r--r-- | internal/processing/status/util.go | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/internal/processing/status/util.go b/internal/processing/status/util.go index 0a023eab6..eb83babb0 100644 --- a/internal/processing/status/util.go +++ b/internal/processing/status/util.go @@ -264,6 +264,10 @@ func (p *processor) processContent(form *apimodel.AdvancedStatusCreateForm, acco // replace newlines with breaks content = strings.ReplaceAll(content, "\n", "<br />") - status.Content = content + // sanitize html to remove any dodgy scripts or other disallowed elements + clean := util.SanitizeHTML(content) + + // set the content as the shiny clean parsed content + status.Content = clean return nil } |