From ad0e26dc04008feec8de0603c88fbd63f87c18ec Mon Sep 17 00:00:00 2001 From: Tobi Smethurst <31960611+tsmethurst@users.noreply.github.com> Date: Mon, 26 Jul 2021 20:25:54 +0200 Subject: Markdown Statuses (#116) * parse markdown statuses if desired * add some preliminary docs for writing posts --- internal/api/model/status.go | 15 +++++++ internal/processing/account/create.go | 4 +- internal/processing/account/update.go | 5 ++- internal/processing/admin/createdomainblock.go | 6 +-- internal/processing/instance.go | 9 ++-- internal/processing/media/create.go | 4 +- internal/processing/media/update.go | 4 +- internal/processing/status/create.go | 3 +- internal/processing/status/status.go | 3 ++ internal/processing/status/util.go | 37 +++++++--------- internal/text/common.go | 46 ++++++++++++++++++++ internal/text/formatter.go | 49 ++++++++++++++++++++++ internal/text/markdown.go | 58 ++++++++++++++++++++++++++ internal/text/plain.go | 50 ++++++++++++++++++++++ internal/text/sanitize.go | 50 ++++++++++++++++++++++ internal/util/sanitize.go | 50 ---------------------- 16 files changed, 304 insertions(+), 89 deletions(-) create mode 100644 internal/text/common.go create mode 100644 internal/text/formatter.go create mode 100644 internal/text/markdown.go create mode 100644 internal/text/plain.go create mode 100644 internal/text/sanitize.go delete mode 100644 internal/util/sanitize.go (limited to 'internal') diff --git a/internal/api/model/status.go b/internal/api/model/status.go index 963ef4f86..ef96568c4 100644 --- a/internal/api/model/status.go +++ b/internal/api/model/status.go @@ -103,6 +103,9 @@ type StatusCreateRequest struct { ScheduledAt string `form:"scheduled_at" json:"scheduled_at" xml:"scheduled_at"` // ISO 639 language code for this status. Language string `form:"language" json:"language" xml:"language"` + // Format in which to parse the submitted status. + // Can be either plain or markdown. Empty will default to plain. + Format StatusFormat `form:"format" json:"format" xml:"format"` } // Visibility denotes the visibility of this status to other users @@ -140,3 +143,15 @@ type AdvancedVisibilityFlagsForm struct { // This status can be liked/faved Likeable *bool `form:"likeable" json:"likeable" xml:"likeable"` } + +// StatusFormat determines what kind of format a submitted status should be parsed in +type StatusFormat string + +// StatusFormatPlain expects a plaintext status which will then be formatted into html. +const StatusFormatPlain StatusFormat = "plain" + +// StatusFormatMarkdown expects a markdown formatted status, which will then be formatted into html. +const StatusFormatMarkdown StatusFormat = "markdown" + +// StatusFormatDefault is the format that should be used when nothing else is specified. +const StatusFormatDefault StatusFormat = StatusFormatPlain diff --git a/internal/processing/account/create.go b/internal/processing/account/create.go index 58ac0e43c..83e76973d 100644 --- a/internal/processing/account/create.go +++ b/internal/processing/account/create.go @@ -23,7 +23,7 @@ import ( apimodel "github.com/superseriousbusiness/gotosocial/internal/api/model" "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" - "github.com/superseriousbusiness/gotosocial/internal/util" + "github.com/superseriousbusiness/gotosocial/internal/text" "github.com/superseriousbusiness/oauth2/v4" ) @@ -45,7 +45,7 @@ func (p *processor) Create(applicationToken oauth2.TokenInfo, application *gtsmo } l.Trace("creating new username and account") - user, err := p.db.NewSignup(form.Username, util.RemoveHTML(reason), p.config.AccountsConfig.RequireApproval, form.Email, form.Password, form.IP, form.Locale, application.ID, false, false) + user, err := p.db.NewSignup(form.Username, text.RemoveHTML(reason), p.config.AccountsConfig.RequireApproval, form.Email, form.Password, form.IP, form.Locale, application.ID, false, false) if err != nil { return nil, fmt.Errorf("error creating new signup in the database: %s", err) } diff --git a/internal/processing/account/update.go b/internal/processing/account/update.go index fbe29ac86..df842bacd 100644 --- a/internal/processing/account/update.go +++ b/internal/processing/account/update.go @@ -28,6 +28,7 @@ import ( apimodel "github.com/superseriousbusiness/gotosocial/internal/api/model" "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" "github.com/superseriousbusiness/gotosocial/internal/media" + "github.com/superseriousbusiness/gotosocial/internal/text" "github.com/superseriousbusiness/gotosocial/internal/util" ) @@ -50,7 +51,7 @@ func (p *processor) Update(account *gtsmodel.Account, form *apimodel.UpdateCrede if err := util.ValidateDisplayName(*form.DisplayName); err != nil { return nil, err } - displayName := util.RemoveHTML(*form.DisplayName) // no html allowed in display name + displayName := text.RemoveHTML(*form.DisplayName) // no html allowed in display name if err := p.db.UpdateOneByID(account.ID, "display_name", displayName, >smodel.Account{}); err != nil { return nil, err } @@ -60,7 +61,7 @@ func (p *processor) Update(account *gtsmodel.Account, form *apimodel.UpdateCrede if err := util.ValidateNote(*form.Note); err != nil { return nil, err } - note := util.SanitizeHTML(*form.Note) // html OK in note but sanitize it + note := text.SanitizeHTML(*form.Note) // html OK in note but sanitize it if err := p.db.UpdateOneByID(account.ID, "note", note, >smodel.Account{}); err != nil { return nil, err } diff --git a/internal/processing/admin/createdomainblock.go b/internal/processing/admin/createdomainblock.go index 78c830a43..df02cef94 100644 --- a/internal/processing/admin/createdomainblock.go +++ b/internal/processing/admin/createdomainblock.go @@ -28,7 +28,7 @@ import ( "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" "github.com/superseriousbusiness/gotosocial/internal/id" - "github.com/superseriousbusiness/gotosocial/internal/util" + "github.com/superseriousbusiness/gotosocial/internal/text" ) func (p *processor) DomainBlockCreate(account *gtsmodel.Account, domain string, obfuscate bool, publicComment string, privateComment string, subscriptionID string) (*apimodel.DomainBlock, gtserror.WithCode) { @@ -52,8 +52,8 @@ func (p *processor) DomainBlockCreate(account *gtsmodel.Account, domain string, ID: blockID, Domain: domain, CreatedByAccountID: account.ID, - PrivateComment: util.RemoveHTML(privateComment), - PublicComment: util.RemoveHTML(publicComment), + PrivateComment: text.RemoveHTML(privateComment), + PublicComment: text.RemoveHTML(publicComment), Obfuscate: obfuscate, SubscriptionID: subscriptionID, } diff --git a/internal/processing/instance.go b/internal/processing/instance.go index 962b841a6..89f60f5d4 100644 --- a/internal/processing/instance.go +++ b/internal/processing/instance.go @@ -25,6 +25,7 @@ import ( "github.com/superseriousbusiness/gotosocial/internal/db" "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" + "github.com/superseriousbusiness/gotosocial/internal/text" "github.com/superseriousbusiness/gotosocial/internal/util" ) @@ -60,7 +61,7 @@ func (p *processor) InstancePatch(form *apimodel.InstanceSettingsUpdateRequest) if err := util.ValidateSiteTitle(*form.Title); err != nil { return nil, gtserror.NewErrorBadRequest(err, fmt.Sprintf("site title invalid: %s", err)) } - i.Title = util.RemoveHTML(*form.Title) // don't allow html in site title + i.Title = text.RemoveHTML(*form.Title) // don't allow html in site title } // validate & update site contact account if it's set on the form @@ -110,7 +111,7 @@ func (p *processor) InstancePatch(form *apimodel.InstanceSettingsUpdateRequest) if err := util.ValidateSiteShortDescription(*form.ShortDescription); err != nil { return nil, gtserror.NewErrorBadRequest(err, err.Error()) } - i.ShortDescription = util.SanitizeHTML(*form.ShortDescription) // html is OK in site description, but we should sanitize it + i.ShortDescription = text.SanitizeHTML(*form.ShortDescription) // html is OK in site description, but we should sanitize it } // validate & update site description if it's set on the form @@ -118,7 +119,7 @@ func (p *processor) InstancePatch(form *apimodel.InstanceSettingsUpdateRequest) if err := util.ValidateSiteDescription(*form.Description); err != nil { return nil, gtserror.NewErrorBadRequest(err, err.Error()) } - i.Description = util.SanitizeHTML(*form.Description) // html is OK in site description, but we should sanitize it + i.Description = text.SanitizeHTML(*form.Description) // html is OK in site description, but we should sanitize it } // validate & update site terms if it's set on the form @@ -126,7 +127,7 @@ func (p *processor) InstancePatch(form *apimodel.InstanceSettingsUpdateRequest) if err := util.ValidateSiteTerms(*form.Terms); err != nil { return nil, gtserror.NewErrorBadRequest(err, err.Error()) } - i.Terms = util.SanitizeHTML(*form.Terms) // html is OK in site terms, but we should sanitize it + i.Terms = text.SanitizeHTML(*form.Terms) // html is OK in site terms, but we should sanitize it } // process avatar if provided diff --git a/internal/processing/media/create.go b/internal/processing/media/create.go index baf9f2918..5b8cdf604 100644 --- a/internal/processing/media/create.go +++ b/internal/processing/media/create.go @@ -26,7 +26,7 @@ import ( apimodel "github.com/superseriousbusiness/gotosocial/internal/api/model" "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" - "github.com/superseriousbusiness/gotosocial/internal/util" + "github.com/superseriousbusiness/gotosocial/internal/text" ) func (p *processor) Create(account *gtsmodel.Account, form *apimodel.AttachmentRequest) (*apimodel.Attachment, error) { @@ -54,7 +54,7 @@ func (p *processor) Create(account *gtsmodel.Account, form *apimodel.AttachmentR // TODO: handle this inside mediaHandler.ProcessAttachment (just pass more params to it) // first description - attachment.Description = util.RemoveHTML(form.Description) // remove any HTML from the image description + attachment.Description = text.RemoveHTML(form.Description) // remove any HTML from the image description // now parse the focus parameter focusx, focusy, err := parseFocus(form.Focus) diff --git a/internal/processing/media/update.go b/internal/processing/media/update.go index b5ffc77d8..28f3a26f6 100644 --- a/internal/processing/media/update.go +++ b/internal/processing/media/update.go @@ -26,7 +26,7 @@ import ( "github.com/superseriousbusiness/gotosocial/internal/db" "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" - "github.com/superseriousbusiness/gotosocial/internal/util" + "github.com/superseriousbusiness/gotosocial/internal/text" ) func (p *processor) Update(account *gtsmodel.Account, mediaAttachmentID string, form *apimodel.AttachmentUpdateRequest) (*apimodel.Attachment, gtserror.WithCode) { @@ -44,7 +44,7 @@ func (p *processor) Update(account *gtsmodel.Account, mediaAttachmentID string, } if form.Description != nil { - attachment.Description = util.RemoveHTML(*form.Description) + attachment.Description = text.RemoveHTML(*form.Description) if err := p.db.UpdateByID(mediaAttachmentID, attachment); err != nil { return nil, gtserror.NewErrorInternalError(fmt.Errorf("database error updating description: %s", err)) } diff --git a/internal/processing/status/create.go b/internal/processing/status/create.go index 37d7e6aab..7480efd60 100644 --- a/internal/processing/status/create.go +++ b/internal/processing/status/create.go @@ -8,6 +8,7 @@ import ( "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" "github.com/superseriousbusiness/gotosocial/internal/id" + "github.com/superseriousbusiness/gotosocial/internal/text" "github.com/superseriousbusiness/gotosocial/internal/util" ) @@ -29,7 +30,7 @@ func (p *processor) Create(account *gtsmodel.Account, application *gtsmodel.Appl Local: true, AccountID: account.ID, AccountURI: account.URI, - ContentWarning: util.RemoveHTML(form.SpoilerText), + ContentWarning: text.RemoveHTML(form.SpoilerText), ActivityStreamsType: gtsmodel.ActivityStreamsNote, Sensitive: form.Sensitive, Language: form.Language, diff --git a/internal/processing/status/status.go b/internal/processing/status/status.go index d83c325fd..0073e254b 100644 --- a/internal/processing/status/status.go +++ b/internal/processing/status/status.go @@ -7,6 +7,7 @@ import ( "github.com/superseriousbusiness/gotosocial/internal/db" "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" + "github.com/superseriousbusiness/gotosocial/internal/text" "github.com/superseriousbusiness/gotosocial/internal/typeutils" "github.com/superseriousbusiness/gotosocial/internal/visibility" ) @@ -40,6 +41,7 @@ type processor struct { config *config.Config db db.DB filter visibility.Filter + formatter text.Formatter fromClientAPI chan gtsmodel.FromClientAPI log *logrus.Logger } @@ -51,6 +53,7 @@ func New(db db.DB, tc typeutils.TypeConverter, config *config.Config, fromClient config: config, db: db, filter: visibility.NewFilter(db, log), + formatter: text.NewFormatter(config, db, log), fromClientAPI: fromClientAPI, log: log, } diff --git a/internal/processing/status/util.go b/internal/processing/status/util.go index eb83babb0..b4d115f8d 100644 --- a/internal/processing/status/util.go +++ b/internal/processing/status/util.go @@ -3,7 +3,6 @@ package status import ( "errors" "fmt" - "strings" apimodel "github.com/superseriousbusiness/gotosocial/internal/api/model" "github.com/superseriousbusiness/gotosocial/internal/db" @@ -238,36 +237,28 @@ func (p *processor) processEmojis(form *apimodel.AdvancedStatusCreateForm, accou } func (p *processor) processContent(form *apimodel.AdvancedStatusCreateForm, accountID string, status *gtsmodel.Status) error { + // if there's nothing in the status at all we can just return early if form.Status == "" { status.Content = "" return nil } - // surround the whole status in '

' - content := fmt.Sprintf(`

%s

`, form.Status) - - // format mentions nicely - for _, menchie := range status.GTSMentions { - targetAccount := >smodel.Account{} - if err := p.db.GetByID(menchie.TargetAccountID, targetAccount); err == nil { - mentionContent := fmt.Sprintf(`@%s`, targetAccount.URL, targetAccount.Username) - content = strings.ReplaceAll(content, menchie.NameString, mentionContent) - } + // if format wasn't specified we should set the default + if form.Format == "" { + form.Format = apimodel.StatusFormatDefault } - // format tags nicely - for _, tag := range status.GTSTags { - tagContent := fmt.Sprintf(``, tag.URL, tag.Name) - content = strings.ReplaceAll(content, fmt.Sprintf("#%s", tag.Name), tagContent) + // parse content out of the status depending on what format has been submitted + var content string + switch form.Format { + case apimodel.StatusFormatPlain: + content = p.formatter.FromPlain(form.Status, status.GTSMentions, status.GTSTags) + case apimodel.StatusFormatMarkdown: + content = p.formatter.FromMarkdown(form.Status, status.GTSMentions, status.GTSTags) + default: + return fmt.Errorf("format %s not recognised as a valid status format", form.Format) } - // replace newlines with breaks - content = strings.ReplaceAll(content, "\n", "
") - - // sanitize html to remove any dodgy scripts or other disallowed elements - clean := util.SanitizeHTML(content) - - // set the content as the shiny clean parsed content - status.Content = clean + status.Content = content return nil } diff --git a/internal/text/common.go b/internal/text/common.go new file mode 100644 index 000000000..0165af630 --- /dev/null +++ b/internal/text/common.go @@ -0,0 +1,46 @@ +/* + GoToSocial + Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . +*/ + +package text + +import ( + "fmt" + "strings" +) + +// preformat contains some common logic for making a string ready for formatting, which should be used for all user-input text. +func preformat(in string) string { + // do some preformatting of the text + // 1. Trim all the whitespace + s := strings.TrimSpace(in) + return s +} + +// postformat contains some common logic for html sanitization of text, wrapping elements, and trimming newlines and whitespace +func postformat(in string) string { + // do some postformatting of the text + // 1. sanitize html to remove any dodgy scripts or other disallowed elements + s := SanitizeHTML(in) + // 2. wrap the whole thing in a paragraph + s = fmt.Sprintf(`

%s

`, s) + // 3. remove any cheeky newlines + s = strings.ReplaceAll(s, "\n", "") + // 4. remove any whitespace added as a result of the formatting + s = strings.TrimSpace(s) + return s +} diff --git a/internal/text/formatter.go b/internal/text/formatter.go new file mode 100644 index 000000000..f8cca6675 --- /dev/null +++ b/internal/text/formatter.go @@ -0,0 +1,49 @@ +/* + GoToSocial + Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . +*/ + +package text + +import ( + "github.com/sirupsen/logrus" + "github.com/superseriousbusiness/gotosocial/internal/config" + "github.com/superseriousbusiness/gotosocial/internal/db" + "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" +) + +// Formatter wraps some logic and functions for parsing statuses and other text input into nice html. +type Formatter interface { + // FromMarkdown parses an HTML text from a markdown-formatted text. + FromMarkdown(md string, mentions []*gtsmodel.Mention, tags []*gtsmodel.Tag) string + // FromPlain parses an HTML text from a plaintext. + FromPlain(plain string, mentions []*gtsmodel.Mention, tags []*gtsmodel.Tag) string +} + +type formatter struct { + cfg *config.Config + db db.DB + log *logrus.Logger +} + +// NewFormatter returns a new Formatter interface for parsing statuses and other text input into nice html. +func NewFormatter(cfg *config.Config, db db.DB, log *logrus.Logger) Formatter { + return &formatter{ + cfg: cfg, + db: db, + log: log, + } +} diff --git a/internal/text/markdown.go b/internal/text/markdown.go new file mode 100644 index 000000000..d1309f389 --- /dev/null +++ b/internal/text/markdown.go @@ -0,0 +1,58 @@ +/* + GoToSocial + Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . +*/ + +package text + +import ( + "fmt" + "strings" + + "github.com/russross/blackfriday/v2" + "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" +) + +var bfExtensions = blackfriday.NoIntraEmphasis | + blackfriday.FencedCode | + blackfriday.Autolink | + blackfriday.Strikethrough | + blackfriday.SpaceHeadings | + blackfriday.BackslashLineBreak + +func (f *formatter) FromMarkdown(md string, mentions []*gtsmodel.Mention, tags []*gtsmodel.Tag) string { + content := preformat(md) + + // do the markdown parsing *first* + content = string(blackfriday.Run([]byte(content), blackfriday.WithExtensions(bfExtensions))) + + // format mentions nicely + for _, menchie := range mentions { + targetAccount := >smodel.Account{} + if err := f.db.GetByID(menchie.TargetAccountID, targetAccount); err == nil { + mentionContent := fmt.Sprintf(`@%s`, targetAccount.URL, targetAccount.Username) + content = strings.ReplaceAll(content, menchie.NameString, mentionContent) + } + } + + // format tags nicely + for _, tag := range tags { + tagContent := fmt.Sprintf(``, tag.URL, tag.Name) + content = strings.ReplaceAll(content, fmt.Sprintf("#%s", tag.Name), tagContent) + } + + return postformat(content) +} diff --git a/internal/text/plain.go b/internal/text/plain.go new file mode 100644 index 000000000..24ef16f8e --- /dev/null +++ b/internal/text/plain.go @@ -0,0 +1,50 @@ +/* + GoToSocial + Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . +*/ + +package text + +import ( + "fmt" + "strings" + + "github.com/superseriousbusiness/gotosocial/internal/gtsmodel" +) + +func (f *formatter) FromPlain(plain string, mentions []*gtsmodel.Mention, tags []*gtsmodel.Tag) string { + content := preformat(plain) + + // format mentions nicely + for _, menchie := range mentions { + targetAccount := >smodel.Account{} + if err := f.db.GetByID(menchie.TargetAccountID, targetAccount); err == nil { + mentionContent := fmt.Sprintf(`@%s`, targetAccount.URL, targetAccount.Username) + content = strings.ReplaceAll(content, menchie.NameString, mentionContent) + } + } + + // format tags nicely + for _, tag := range tags { + tagContent := fmt.Sprintf(``, tag.URL, tag.Name) + content = strings.ReplaceAll(content, fmt.Sprintf("#%s", tag.Name), tagContent) + } + + // replace newlines with breaks + content = strings.ReplaceAll(content, "\n", "
") + + return postformat(content) +} diff --git a/internal/text/sanitize.go b/internal/text/sanitize.go new file mode 100644 index 000000000..aac9d8aab --- /dev/null +++ b/internal/text/sanitize.go @@ -0,0 +1,50 @@ +/* + GoToSocial + Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . +*/ + +package text + +import ( + "github.com/microcosm-cc/bluemonday" +) + +// '[A]llows a broad selection of HTML elements and attributes that are safe for user generated content. +// Note that this policy does not allow iframes, object, embed, styles, script, etc. +// An example usage scenario would be blog post bodies where a variety of formatting is expected along with the potential for TABLEs and IMGs.' +// +// Source: https://github.com/microcosm-cc/bluemonday#usage +var regular *bluemonday.Policy = bluemonday.UGCPolicy(). + RequireNoReferrerOnLinks(true). + RequireNoFollowOnLinks(true). + RequireCrossOriginAnonymous(true) + +// '[C]an be thought of as equivalent to stripping all HTML elements and their attributes as it has nothing on its allowlist. +// An example usage scenario would be blog post titles where HTML tags are not expected at all +// and if they are then the elements and the content of the elements should be stripped. This is a very strict policy.' +// +// Source: https://github.com/microcosm-cc/bluemonday#usage +var strict *bluemonday.Policy = bluemonday.StrictPolicy() + +// SanitizeHTML cleans up HTML in the given string, allowing through only safe HTML elements. +func SanitizeHTML(in string) string { + return regular.Sanitize(in) +} + +// RemoveHTML removes all HTML from the given string. +func RemoveHTML(in string) string { + return strict.Sanitize(in) +} diff --git a/internal/util/sanitize.go b/internal/util/sanitize.go deleted file mode 100644 index ac1f4c651..000000000 --- a/internal/util/sanitize.go +++ /dev/null @@ -1,50 +0,0 @@ -/* - GoToSocial - Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program. If not, see . -*/ - -package util - -import ( - "github.com/microcosm-cc/bluemonday" -) - -// '[A]llows a broad selection of HTML elements and attributes that are safe for user generated content. -// Note that this policy does not allow iframes, object, embed, styles, script, etc. -// An example usage scenario would be blog post bodies where a variety of formatting is expected along with the potential for TABLEs and IMGs.' -// -// Source: https://github.com/microcosm-cc/bluemonday#usage -var regular *bluemonday.Policy = bluemonday.UGCPolicy(). - RequireNoReferrerOnLinks(true). - RequireNoFollowOnLinks(true). - RequireCrossOriginAnonymous(true) - -// '[C]an be thought of as equivalent to stripping all HTML elements and their attributes as it has nothing on its allowlist. -// An example usage scenario would be blog post titles where HTML tags are not expected at all -// and if they are then the elements and the content of the elements should be stripped. This is a very strict policy.' -// -// Source: https://github.com/microcosm-cc/bluemonday#usage -var strict *bluemonday.Policy = bluemonday.StrictPolicy() - -// SanitizeHTML cleans up HTML in the given string, allowing through only safe HTML elements. -func SanitizeHTML(in string) string { - return regular.Sanitize(in) -} - -// RemoveHTML removes all HTML from the given string. -func RemoveHTML(in string) string { - return strict.Sanitize(in) -} -- cgit v1.3