Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GFI response handling improvements #133

Merged
merged 2 commits into from
Jan 19, 2018

Conversation

ZakarFin
Copy link
Member

@ZakarFin ZakarFin commented Jan 19, 2018

Continues the work done in PR #77.

Allows target attribute and data-urls for images in GFI responses by default (oskari.properties).

The allowed tags for HTML-sanitation can now be configured in oskari-ext.properties. Without any config the basic allowed tags are described in #77 as "Jsoup relaxed" setting. The configuration can be used to allow more tags/attributes/protocols, but NOT restrict it. For allowing more tags for the GFI-functionality you can use these properties:

# allowed tags
gfi.html.whitelist=additional,tags,as,comma,separated,list

# allowed attributes for a tag (like html.whitelist.attr.a=target)
gfi.html.whitelist.attr.[tag]=attributes,for,tag,as,comma,separated,list

# allowed protocols in an attribute value for a tag (like html.whitelist.attr.a.protocol.href=ftp)
gfi.html.whitelist.attr.[tag].protocol.[attr]=ftp

# true if <img src="data:..." /> data urls in images are allowed
gfi.html.whitelist.attr.img.dataurl=[true or false, defaults to true for gfi]

All links will get target="_blank" automatically for GFI responses (if target attribute is allowed for links). All relative links/images are transformed to absolute urls in GFI (/something to https://base.url/something).

Added a generic HTML-sanitation class and a Jsoup whitelist implementation to allow data-urls in images. This can be used in other places, but currently is not:

    String sanitizedHtml =  new org.oskari.util.HtmlDoc("htmlStr")
            .modifyLinks("https://my.base.url.for.relative.urls")
            .getFiltered([optional prefix for config as string]);

The config prefix can be omitted. Properties without any prefix like "html.whitelist" are used in that case. For example the gfi functionality uses prefix "gfi" which results in properties like "gfi.html.whitelist". The call to modifyLinks can also be omitted.

@jampukka
Copy link
Member

Looks good to me

@ZakarFin ZakarFin added this to the 1.45.0 milestone Jan 19, 2018
@ZakarFin ZakarFin merged commit 372bdc4 into oskariorg:develop Jan 19, 2018
@ZakarFin ZakarFin deleted the fix/gfi-content-sanitation branch January 19, 2018 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants