make blog/instance description a SafeString

[igalic]

long_description & short_description's documentation say they can be
Markdown, but they are String, not SafeString.

This led to escaped strings being printed in the editor
#220

[igalic]

n.b.: This is a work-in-progress and does not solve the problem yet

[pwoolcoc]

For the FromFormValue problem, you should be able to delegate the parsing to the String::from_form_value method. I haven't compiled this but it should go something like:

// safe_string.rs
use rocket::request::FromFormValue;
use rocket::http::RawStr;

impl<'v> FromFormValue<'v> for SafeString {
    type Error = &'v RawStr;

    fn from_form_value(form_value: &'v RawStr) -> Result<SafeString, &'v RawStr> {
        let val = String::from_form_value(form_value)?;
        Ok(SafeString {
          value: val,
        })
    }
}

[pwoolcoc]

you can change &<String>::new here to just "", since SafeString::new() takes a &str. It will save an allocation, at least, especially since currently the allocation just gets dropped and another is made in the ammonia::clean function.

[pwoolcoc]

Same comment here re: String::new

[pwoolcoc]

and here as well

[igalic]

@pwoolcoc thank you for your review!
i've pushed one commit which addresses your concerns wrt allocation, and one which adds your imp FromFormValue for SafeString… now… to make use of it ;)

(by which i mean, "now to find out how to make use of it")

[elegaanz]

@igalic Thanks for working on this. Rocket will use your FromFormValue directly if you replace the String fields of the form struct (InstanceSettingsForm in src/routes/instance.rs) by SafeString.

[igalic]

big confused about @pwoolcoc's code here ;)

[igalic]

okay! so with the last commit (06718a5) i've now done everything everyone on here has so helpfully suggested

which means that it now… still doesn't work 😅

[trinity-1686a]

I think you did all that was needed on rust side. Now you just have to edit templates to add | safe whenever one of the vars you changed to SafeString is used as done here for user's summary

Plume/templates/users/header.html.tera

Line 41 in d355379

{{ user.summary | safe }}

This should be in templates/instance/admin.html.tera I think.

[igalic]

but that's not done with content:

Plume/templates/posts/new.html.tera

Line 31 in d355379

<textarea id="content" name="content" rows="20">{{ form.content | default(value="") }}</textarea>

[igalic]

@fdb-hiroshima i tried | safe anyway, and it did nothing!

[trinity-1686a]

The exact line you need is <textarea id="short_description" name="short_description">{{ form.short_description | default(value=instance.short_description | safe) }}</textarea>, with the | safe inside default's brackets. The difference with post's content is instance.short_description is read by default, not passed directly (same goes with long_description). I'm sorry I was not clear enough in my previous comment