github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-10 17:57:48 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Allow sanitized-HTML in GH issues and categories oneboxes. (#25374)

Browse Source 
Follow-up to d78357917c

Related meta topic: https://meta.discourse.org/t/html-is-not-render-on-category-onebox-description/289424:
This commit is contained in:
Roman Rizzi
2024-01-22 15:25:29 -03:00
committed by GitHub
parent a37d26f559
commit a709b7e861
4 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/onebox/engine/github_issue_onebox.rb
View File

@ -40,7 +40,10 @@ module Onebox
body, excerpt = compute_body(raw["body"]) body, excerpt = compute_body(raw["body"])
ulink = URI(link) ulink = URI(link)
labels = raw["labels"].map { |l| { name: Emoji.codes_to_img(CGI.escapeHTML(l["name"])) } } labels =
raw["labels"].map do |l|
{ name: Emoji.codes_to_img(Onebox::Helpers.sanitize(l["name"])) }
end
{ {
link: @url, link: @url,

2
lib/onebox/templates/discourse_category_onebox.mustache
View File

@ -12,7 +12,7 @@
{{#description}} {{#description}}
<div> <div>
<span class="description"> <span class="description">
<p>{{description}}</p> <p>{{{description}}}</p>
</span> </span>
</div> </div>
{{/description}} {{/description}}

2
lib/oneboxer.rb
View File

@ -486,7 +486,7 @@ module Oneboxer
name: category.name, name: category.name,
color: category.color, color: category.color,
logo_url: category.uploaded_logo&.url, logo_url: category.uploaded_logo&.url,
description: category.description, description: Onebox::Helpers.sanitize(category.description),
has_subcategories: category.subcategories.present?, has_subcategories: category.subcategories.present?,
subcategories: subcategories:
category.subcategories.collect { |sc| { name: sc.name, color: sc.color, url: sc.url } }, category.subcategories.collect { |sc| { name: sc.name, color: sc.color, url: sc.url } },

2
spec/lib/onebox/engine/github_issue_onebox_spec.rb
View File

@ -16,7 +16,7 @@ RSpec.describe Onebox::Engine::GithubIssueOnebox do
describe "#to_html" do describe "#to_html" do
it "sanitizes the input and transform the emoji into an img tag" do it "sanitizes the input and transform the emoji into an img tag" do
sanitized_label = sanitized_label =
'Test <img src="/images/emoji/twitter/+1.png?v=12" title="+1" class="emoji" alt="+1" loading="lazy" width="20" height="20"> &lt;style&gt;body {display: none}&lt;/style&gt;' 'Test <img src="/images/emoji/twitter/+1.png?v=12" title="+1" class="emoji" alt="+1" loading="lazy" width="20" height="20">'
expect(html).to include(sanitized_label) expect(html).to include(sanitized_label)
end end