From 14f90e70397e69a3c461f0e3c1d038188d8805c9 Mon Sep 17 00:00:00 2001 From: Umputun Date: Sun, 13 May 2018 13:48:37 -0500 Subject: [PATCH] allow code attributes in sanitizer --- app/store/comment.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/store/comment.go b/app/store/comment.go index e42097f4..317d2337 100644 --- a/app/store/comment.go +++ b/app/store/comment.go @@ -7,6 +7,7 @@ import ( "hash/crc64" "html/template" "log" + "regexp" "strconv" "time" @@ -87,6 +88,7 @@ func (c *Comment) SetDeleted() { // Sanitize clean dangerous html/js from the comment func (c *Comment) Sanitize() { p := bluemonday.UGCPolicy() + p.AllowAttrs("class").Matching(regexp.MustCompile("^language-[a-zA-Z0-9]+$")).OnElements("code") c.Text = p.Sanitize(c.Text) c.User.ID = template.HTMLEscapeString(c.User.ID) c.User.Name = template.HTMLEscapeString(c.User.Name)