Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-02-27 17:11:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: add another sanitization round before federating to remove classes from all tags in output html, closes #12573

Browse Source
This commit is contained in:
Julian Lam
2024-05-23 15:29:32 -04:00
parent 09e71e94a2
commit 7c79e2310a
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/activitypub/mocks.js
View File

@@ -3,6 +3,7 @@
const nconf = require('nconf'); const nconf = require('nconf');
const mime = require('mime'); const mime = require('mime');
const path = require('path'); const path = require('path');
const sanitize = require('sanitize-html');
const meta = require('../meta'); const meta = require('../meta');
const user = require('../user'); const user = require('../user');
@@ -16,6 +17,16 @@ const utils = require('../utils');
const activitypub = module.parent.exports; const activitypub = module.parent.exports;
const Mocks = module.exports; const Mocks = module.exports;
/**
* A more restrictive html sanitization run on top of standard sanitization from core.
* Done so the output HTML is stripped of all non-essential items; mainly classes from plugins..
*/
const sanitizeConfig = {
allowedClasses: {
'*': [],
},
};
Mocks.profile = async (actors) => { Mocks.profile = async (actors) => {
// Should only ever be called by activitypub.actors.assert // Should only ever be called by activitypub.actors.assert
const profiles = (await Promise.all(actors.map(async (actor) => { const profiles = (await Promise.all(actors.map(async (actor) => {
@@ -267,7 +278,7 @@ Mocks.note = async (post) => {
postData: { content }, postData: { content },
type: 'activitypub.note', type: 'activitypub.note',
}); });
post.content = parsed.content; post.content = sanitize(parsed.content, sanitizeConfig);
post.content = posts.relativeToAbsolute(post.content, posts.urlRegex); post.content = posts.relativeToAbsolute(post.content, posts.urlRegex);
post.content = posts.relativeToAbsolute(post.content, posts.imgRegex); post.content = posts.relativeToAbsolute(post.content, posts.imgRegex);