From 5296074dae8e63259e1cf5c7734cb6caf450918a Mon Sep 17 00:00:00 2001 From: Umputun Date: Mon, 18 Jan 2021 15:36:15 -0600 Subject: [PATCH] fix sanitize policy to allow loading-lazy for images #855 --- backend/app/rest/api/rest_private_test.go | 16 ++++++++++++++++ backend/app/store/comment.go | 1 + 2 files changed, 17 insertions(+) diff --git a/backend/app/rest/api/rest_private_test.go b/backend/app/rest/api/rest_private_test.go index 1ebfa1d9..d0a052f0 100644 --- a/backend/app/rest/api/rest_private_test.go +++ b/backend/app/rest/api/rest_private_test.go @@ -161,6 +161,22 @@ func TestRest_CreateRejected(t *testing.T) { require.Equal(t, http.StatusForbidden, resp.StatusCode, "reject wrong aud") } +func TestRest_CreateWithLazyImage(t *testing.T) { + ts, _, teardown := startupT(t) + defer teardown() + body := `{"text": "test 123 ![](http://example.com/image.png)", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}` + // create comment + resp, err := post(t, ts.URL+"/api/v1/comment", body) + require.NoError(t, err) + require.Equal(t, http.StatusCreated, resp.StatusCode) + b, err := ioutil.ReadAll(resp.Body) + assert.NoError(t, err) + c := store.Comment{} + err = json.Unmarshal(b, &c) + assert.NoError(t, err) + assert.Equal(t, c.Text, "

test 123 \"\"

\n") +} + func TestRest_CreateAndGet(t *testing.T) { ts, _, teardown := startupT(t) defer teardown() diff --git a/backend/app/store/comment.go b/backend/app/store/comment.go index e162142c..b2c902dd 100644 --- a/backend/app/store/comment.go +++ b/backend/app/store/comment.go @@ -118,6 +118,7 @@ func (c *Comment) Sanitize() { "|vi|vm|l|ld|s|sa|sb|sc|dl|sd|s2|se|sh|si|sx|sr|s1|ss|m|mb|mf|mh|mi|il" + "|mo|o|ow|p|c|ch|cm|cp|cpf|c1|cs|g|gd|ge|gr|gh|gi|go|gp|gs|gu|gt|gl)$" p.AllowAttrs("class").Matching(regexp.MustCompile(codeSpanClassRegex)).OnElements("span") + p.AllowAttrs("loading").Matching(regexp.MustCompile("^(lazy|eager)$")).OnElements("img") c.Text = p.Sanitize(c.Text) c.Orig = p.Sanitize(c.Orig) c.User.ID = template.HTMLEscapeString(c.User.ID)