Skip to content

Swap out simple-xss for sanitize-html #190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sizzlemctwizzle merged 7 commits into from
Jun 21, 2014
Merged

Swap out simple-xss for sanitize-html #190

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
959e259
Swap out simple-xss for sanitize-html
Jun 20, 2014
fafa04c
Flip order of processing and allow img tag
Jun 20, 2014
7097881
Revert last commit... otherwise DOM is stripped of highlighting capab…
Jun 20, 2014
c31e8db
Match some of [GH's](https://github.com/github/markup#html-sanitizati…
Jun 20, 2014
2b5e93d
Move html whitelist to a json file so it doesn't clutter up the main …
Jun 20, 2014
6891f97
White space adjustment and removal of console message.
Jun 20, 2014
41c359f
Rename json to be more specific and change affected code
Jun 20, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 76 additions & 0 deletions libs/htmlWhitelistPost.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
{
"allowedTags": [
"h1",
"h2",
"h3",
"h4",
"h5",
"h6",
"h7",
"h8",
"p",
"div",
"blockquote",
"pre",
"b",
"i",
"strong",
"em",
"tt",
"code",
"ins",
"del",
"sup",
"sub",
"kbd",
"samp",
"q",
"var",
"ol",
"ul",
"li",
"dl",
"dt",
"dd",
"table",
"thead",
"tbody",
"tfoot",
"tr",
"td",
"th",
"br",
"hr",
"ruby",
"rt",
"rp"
],
"allowedAttributes": {
"a": [
"href"
],
"img": [
"src"
],
"div": [
"itemscope",
"itemtype"
]
},
"selfClosing": [
"img",
"br",
"hr",
"area",
"base",
"basefont",
"input",
"link",
"meta"
],
"allowedSchemes": [
"http",
"https",
"mailto"
]
}
7 changes: 4 additions & 3 deletions libs/markdown.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
var marked = require('marked');
var hljs = require('highlight.js');
var xss = require('simple-xss');
var sanitizeHtml = require('sanitize-html');
var htmlWhitelistPost = require('./htmlWhitelistPost.json');
var renderer = new marked.Renderer();

// Automatically generate an anchor for each header
Expand Down Expand Up @@ -33,11 +34,11 @@ marked.setOptions({
tables: true,
breaks: true,
pedantic: false,
sanitize: false, // we use xss to sanitize HTML
sanitize: false, // we use sanitize-html to sanitize HTML
smartLists: true,
smartypants: false
});

exports.renderMd = function (text) {
return xss(marked(text));
return marked(sanitizeHtml(text), htmlWhitelistPost);
};
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"async": "*",
"aws-sdk": "*",
"toobusy-js": "*",
"simple-xss": "*",
"sanitize-html": "*",
"underscore": "*",
"moment": "*",
"github": "*",
Expand Down