From 94d0e012dea89058b9c059636fb6d42f6565e534 Mon Sep 17 00:00:00 2001 From: nightpool Date: Sat, 17 Jun 2017 14:26:05 -0400 Subject: Whitelist allowed classes for federated statuses (#3810) * Whitelist allowed classes for federated statuses Allowed classes are currently: - Any microformats class (h/p/u/dt/e-*) - the classes mention, hashtag, ellipses and invisible. this last one is somewhat suspect, but Mastodon currently uses it to render hidden link text. resolved #3790 * Fix code style --- app/lib/sanitize_config.rb | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) (limited to 'app') diff --git a/app/lib/sanitize_config.rb b/app/lib/sanitize_config.rb index 9cf9b3db0..f09288fcd 100644 --- a/app/lib/sanitize_config.rb +++ b/app/lib/sanitize_config.rb @@ -4,6 +4,21 @@ class Sanitize module Config HTTP_PROTOCOLS ||= ['http', 'https', :relative].freeze + CLASS_WHITELIST_TRANSFORMER = lambda do |env| + node = env[:node] + class_list = node['class']&.split(' ') + + return unless class_list + + class_list.keep_if do |e| + return true if e =~ /^(h|p|u|dt|e)-/ # microformats classes + return true if e =~ /^(mention|hashtag)$/ # semantic classes + return true if e =~ /^(ellipsis|invisible)$/ # link formatting classes + end + + node['class'] = class_list.join(' ') + end + MASTODON_STRICT ||= freeze_config( elements: %w(p br span a), @@ -21,7 +36,11 @@ class Sanitize protocols: { 'a' => { 'href' => HTTP_PROTOCOLS }, - } + }, + + transformers: [ + CLASS_WHITELIST_TRANSFORMER, + ] ) MASTODON_OEMBED ||= freeze_config merge( -- cgit