SuperSeriousBusiness/GoToSocial
1
1
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial synced 2025-06-05 21:59:39 +02:00
Code Issues Projects Releases Wiki Activity

sanitize html for statuses + instance (#97)

Browse Source 
* sanitize html for statuses + instance

* sanitization
This commit is contained in:
Tobi Smethurst
2021-07-13 16:03:51 +02:00
committed by GitHub
parent 846057f0d6
commit bdba3ff9a9
12 changed files with 99 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
internal/processing/instance.go
View File

@ -60,7 +60,7 @@ func (p *processor) InstancePatch(form *apimodel.InstanceSettingsUpdateRequest)
if err := util.ValidateSiteTitle(*form.Title); err != nil {
return nil, gtserror.NewErrorBadRequest(err, fmt.Sprintf("site title invalid: %s", err))
}
i.Title = *form.Title
i.Title = util.RemoveHTML(*form.Title) // don't allow html in site title
}
// validate & update site contact account if it's set on the form
@ -110,7 +110,7 @@ func (p *processor) InstancePatch(form *apimodel.InstanceSettingsUpdateRequest)
if err := util.ValidateSiteShortDescription(*form.ShortDescription); err != nil {
return nil, gtserror.NewErrorBadRequest(err, err.Error())
}
i.ShortDescription = *form.ShortDescription
i.ShortDescription = util.SanitizeHTML(*form.ShortDescription) // html is OK in site description, but we should sanitize it
}
// validate & update site description if it's set on the form
@ -118,7 +118,7 @@ func (p *processor) InstancePatch(form *apimodel.InstanceSettingsUpdateRequest)
if err := util.ValidateSiteDescription(*form.Description); err != nil {
return nil, gtserror.NewErrorBadRequest(err, err.Error())
}
i.Description = *form.Description
i.Description = util.SanitizeHTML(*form.Description) // html is OK in site description, but we should sanitize it
}
// validate & update site terms if it's set on the form
@ -126,7 +126,7 @@ func (p *processor) InstancePatch(form *apimodel.InstanceSettingsUpdateRequest)
if err := util.ValidateSiteTerms(*form.Terms); err != nil {
return nil, gtserror.NewErrorBadRequest(err, err.Error())
}
i.Terms = *form.Terms
i.Terms = util.SanitizeHTML(*form.Terms) // html is OK in site terms, but we should sanitize it
}
// process avatar if provided