diff options
| author | Unknwon <u@gogs.io> | 2017-03-29 19:52:53 -0400 |
|---|---|---|
| committer | Unknwon <u@gogs.io> | 2017-03-29 19:52:53 -0400 |
| commit | 9d06ebd01a07b51ab2513e171dcfb79183c4997c (patch) | |
| tree | 54222bf85bc0c1c2c51425486354256ad4b25421 /modules/markdown | |
| parent | 09723ec0e5be9aae41d6fc3ad87d3eabe1035376 (diff) | |
markdown: improve filter of class attribute for code blocks
Only allow HighlightJS specific classes.
Reported by ChALkeR.
Diffstat (limited to 'modules/markdown')
| -rw-r--r-- | modules/markdown/markdown.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/modules/markdown/markdown.go b/modules/markdown/markdown.go index 0af0d908..6101670c 100644 --- a/modules/markdown/markdown.go +++ b/modules/markdown/markdown.go @@ -32,8 +32,8 @@ var Sanitizer = bluemonday.UGCPolicy() // BuildSanitizer initializes sanitizer with allowed attributes based on settings. // This function should only be called once during entire application lifecycle. func BuildSanitizer() { - // Normal markdown-stuff - Sanitizer.AllowAttrs("class").Matching(regexp.MustCompile(`[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&]*`)).OnElements("code") + // We only want to allow HighlightJS specific classes for code blocks + Sanitizer.AllowAttrs("class").Matching(regexp.MustCompile(`^language-\w+`)).OnElements("code") // Checkboxes Sanitizer.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input") |