SuperSeriousBusiness/GoToSocial
1
1
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial synced 2025-06-05 21:59:39 +02:00
Code Issues Projects Releases Wiki Activity

[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100)

Browse Source
This commit is contained in:
tobi
2023-08-11 14:40:11 +02:00
committed by GitHub
parent 3aedd937c3
commit dc96562b40
17 changed files with 243 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
internal/processing/account/update.go
View File

@@ -67,7 +67,7 @@ func (p *Processor) Update(ctx context.Context, account *gtsmodel.Account, form
}
// Parse new display name (always from plaintext).
account.DisplayName = text.SanitizePlaintext(displayName)
account.DisplayName = text.SanitizeToPlaintext(displayName)
// If display name has changed, account emojis may have also changed.
emojisChanged = true
@@ -110,8 +110,8 @@ func (p *Processor) Update(ctx context.Context, account *gtsmodel.Account, form
// Sanitize raw field values.
fieldRaw := &gtsmodel.Field{
Name: text.SanitizePlaintext(name),
Value: text.SanitizePlaintext(value),
Name: text.SanitizeToPlaintext(name),
Value: text.SanitizeToPlaintext(value),
}
fieldsRaw = append(fieldsRaw, fieldRaw)
}
@@ -255,7 +255,7 @@ func (p *Processor) Update(ctx context.Context, account *gtsmodel.Account, form
if err := validate.CustomCSS(customCSS); err != nil {
return nil, gtserror.NewErrorBadRequest(err, err.Error())
}
account.CustomCSS = text.SanitizePlaintext(customCSS)
account.CustomCSS = text.SanitizeToPlaintext(customCSS)
}
if form.EnableRSS != nil {