Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make sanitization configurable #1715

Merged
merged 1 commit into from
Mar 22, 2018
Merged

Make sanitization configurable #1715

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions browser/components/MarkdownEditor.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -280,6 +280,7 @@ class MarkdownEditor extends React.Component {
indentSize={editorIndentSize}
scrollPastEnd={config.preview.scrollPastEnd}
smartQuotes={config.preview.smartQuotes}
sanitize={config.preview.sanitize}
ref='preview'
onContextMenu={(e) => this.handleContextMenu(e)}
onDoubleClick={(e) => this.handleDoubleClick(e)}
Expand Down
9 changes: 6 additions & 3 deletions browser/components/MarkdownPreview.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,8 +135,11 @@ export default class MarkdownPreview extends React.Component {
}

initMarkdown () {
const { smartQuotes } = this.props
this.markdown = new Markdown({ typographer: smartQuotes })
const { smartQuotes, sanitize } = this.props
this.markdown = new Markdown({
typographer: smartQuotes,
sanitize
})
}

handlePreviewAnchorClick (e) {
Expand Down Expand Up @@ -318,7 +321,7 @@ export default class MarkdownPreview extends React.Component {

componentDidUpdate (prevProps) {
if (prevProps.value !== this.props.value) this.rewriteIframe()
if (prevProps.smartQuotes !== this.props.smartQuotes) {
if (prevProps.smartQuotes !== this.props.smartQuotes || prevProps.sanitize !== this.props.sanitize) {
this.initMarkdown()
this.rewriteIframe()
}
Expand Down
1 change: 1 addition & 0 deletions browser/components/MarkdownSplitEditor.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,7 @@ class MarkdownSplitEditor extends React.Component {
lineNumber={config.preview.lineNumber}
scrollPastEnd={config.preview.scrollPastEnd}
smartQuotes={config.preview.smartQuotes}
sanitize={config.preview.sanitize}
ref='preview'
tabInde='0'
value={value}
Expand Down
86 changes: 48 additions & 38 deletions browser/lib/markdown.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,52 +45,62 @@ class Markdown {
'<code class="' + langType + '">' +
str +
'</code></pre>'
}
},
sanitize: 'STRICT'
}

const updatedOptions = Object.assign(defaultOptions, options)
this.md = markdownit(updatedOptions)

// Sanitize use rinput before other plugins
this.md.use(sanitize, {
allowedTags: ['iframe', 'input', 'b',
if (updatedOptions.sanitize !== 'NONE') {
const allowedTags = ['iframe', 'input', 'b',
'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'h7', 'h8', 'br', 'b', 'i', 'strong', 'em', 'a', 'pre', 'code', 'img', 'tt',
'div', 'ins', 'del', 'sup', 'sub', 'p', 'ol', 'ul', 'table', 'thead', 'tbody', 'tfoot', 'blockquote',
'dl', 'dt', 'dd', 'kbd', 'q', 'samp', 'var', 'hr', 'ruby', 'rt', 'rp', 'li', 'tr', 'td', 'th', 's', 'strike', 'summary', 'details'
],
allowedAttributes: {
'*': [
'style',
'abbr', 'accept', 'accept-charset',
'accesskey', 'action', 'align', 'alt', 'axis',
'border', 'cellpadding', 'cellspacing', 'char',
'charoff', 'charset', 'checked',
'clear', 'cols', 'colspan', 'color',
'compact', 'coords', 'datetime', 'dir',
'disabled', 'enctype', 'for', 'frame',
'headers', 'height', 'hreflang',
'hspace', 'ismap', 'label', 'lang',
'maxlength', 'media', 'method',
'multiple', 'name', 'nohref', 'noshade',
'nowrap', 'open', 'prompt', 'readonly', 'rel', 'rev',
'rows', 'rowspan', 'rules', 'scope',
'selected', 'shape', 'size', 'span',
'start', 'summary', 'tabindex', 'target',
'title', 'type', 'usemap', 'valign', 'value',
'vspace', 'width', 'itemprop'
],
'a': ['href'],
'div': ['itemscope', 'itemtype'],
'blockquote': ['cite'],
'del': ['cite'],
'ins': ['cite'],
'q': ['cite'],
'img': ['src', 'width', 'height'],
'iframe': ['src', 'width', 'height', 'frameborder', 'allowfullscreen'],
'input': ['type', 'id', 'checked']
},
allowedIframeHostnames: ['www.youtube.com']
})
]
const allowedAttributes = [
'abbr', 'accept', 'accept-charset',
'accesskey', 'action', 'align', 'alt', 'axis',
'border', 'cellpadding', 'cellspacing', 'char',
'charoff', 'charset', 'checked',
'clear', 'cols', 'colspan', 'color',
'compact', 'coords', 'datetime', 'dir',
'disabled', 'enctype', 'for', 'frame',
'headers', 'height', 'hreflang',
'hspace', 'ismap', 'label', 'lang',
'maxlength', 'media', 'method',
'multiple', 'name', 'nohref', 'noshade',
'nowrap', 'open', 'prompt', 'readonly', 'rel', 'rev',
'rows', 'rowspan', 'rules', 'scope',
'selected', 'shape', 'size', 'span',
'start', 'summary', 'tabindex', 'target',
'title', 'type', 'usemap', 'valign', 'value',
'vspace', 'width', 'itemprop'
]

if (updatedOptions.sanitize === 'ALLOW_STYLES') {
allowedTags.push('style')
allowedAttributes.push('style')
}

// Sanitize use rinput before other plugins
this.md.use(sanitize, {
allowedTags,
allowedAttributes: {
'*': allowedAttributes,
'a': ['href'],
'div': ['itemscope', 'itemtype'],
'blockquote': ['cite'],
'del': ['cite'],
'ins': ['cite'],
'q': ['cite'],
'img': ['src', 'width', 'height'],
'iframe': ['src', 'width', 'height', 'frameborder', 'allowfullscreen'],
'input': ['type', 'id', 'checked']
},
allowedIframeHostnames: ['www.youtube.com']
})
}

this.md.use(emoji, {
shortcuts: {}
Expand Down
3 changes: 2 additions & 1 deletion browser/main/lib/ConfigManager.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,8 @@ export const DEFAULT_CONFIG = {
latexBlockOpen: '$$',
latexBlockClose: '$$',
scrollPastEnd: false,
smartQuotes: true
smartQuotes: true,
sanitize: 'STRICT' // 'STRICT', 'ALLOW_STYLES', 'NONE'
},
blog: {
type: 'wordpress', // Available value: wordpress, add more types in the future plz
Expand Down
20 changes: 19 additions & 1 deletion browser/main/modals/PreferencesModal/UiTab.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,8 @@ class UiTab extends React.Component {
latexBlockOpen: this.refs.previewLatexBlockOpen.value,
latexBlockClose: this.refs.previewLatexBlockClose.value,
scrollPastEnd: this.refs.previewScrollPastEnd.checked,
smartQuotes: this.refs.previewSmartQuotes.checked
smartQuotes: this.refs.previewSmartQuotes.checked,
sanitize: this.refs.previewSanitize.value
}
}

Expand Down Expand Up @@ -441,6 +442,23 @@ class UiTab extends React.Component {
Enable smart quotes
</label>
</div>

<div styleName='group-section'>
<div styleName='group-section-label'>
{i18n.__('Sanitization')}
</div>
<div styleName='group-section-control'>
<select value={config.preview.sanitize}
ref='previewSanitize'
onChange={(e) => this.handleUIChange(e)}
>
<option value='STRICT'>✅ {i18n.__('Only allow secure html tags (recommended)')}
</option>
<option value='ALLOW_STYLES'>⚠️ {i18n.__('Allow styles')}</option>
<option value='NONE'>❌ {i18n.__('Allow dangerous html tags')}</option>
</select>
</div>
</div>
<div styleName='group-section'>
<div styleName='group-section-label'>
{i18n.__('LaTeX Inline Open Delimiter')}
Expand Down
6 changes: 5 additions & 1 deletion locales/da.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/de.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,5 +143,9 @@
"Successfully applied!": "Erfolgreich angewendet!",
"UserName": "UserName",
"Password": "Password",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/en.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,5 +144,9 @@
"UserName": "UserName",
"Password": "Password",
"Russian": "Russian",
"Command(⌘)": "Command(⌘)"
"Command(⌘)": "Command(⌘)",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/es.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
10 changes: 8 additions & 2 deletions locales/fr.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,5 +139,11 @@
"Polish": "Polonais",
"Portuguese": "Portugais",
"Spanish": "Espagnol",
"You have to save!": "Il faut sauvegarder !"
}
"You have to save!": "Il faut sauvegarder !",
"Russian": "Russian",
"Allow preview to scroll past the last line": "Allow preview to scroll past the last line",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/ja.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/ko.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,5 +148,9 @@
"UserName": "유저명",
"Password": "패스워드",
"Storage": "저장소",
"Hotkeys": "단축키"
"Hotkeys": "단축키",
"Sanitization": "허용 태그 범위",
"Only allow secure html tags (recommended)": "안전한 HTML 태그만 허용 (추천)",
"Allow styles": "style 태그, 속성까지 허용",
"Allow dangerous html tags": "모든 위험한 태그 허용"
}
6 changes: 5 additions & 1 deletion locales/no.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/pl.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/pt.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/sq.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/zh-CN.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}
6 changes: 5 additions & 1 deletion locales/zh-TW.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,5 +141,9 @@
"Portuguese": "Portuguese",
"Spanish": "Spanish",
"You have to save!": "You have to save!",
"Russian": "Russian"
"Russian": "Russian",
"Sanitization": "Sanitization",
"Only allow secure html tags (recommended)": "Only allow secure html tags (recommended)",
"Allow styles": "Allow styles",
"Allow dangerous html tags": "Allow dangerous html tags"
}