Skip to content

Commit 711ca0c

Browse files
6543zeripath
6543
and
zeripath
authored
Update to bluemonday-1.0.6 (#15294) (#15298)
Signed-off-by: Andrew Thornton <[email protected]> Co-authored-by: zeripath <[email protected]>
1 parent 013639b commit 711ca0c

File tree

13 files changed

+124
-66
lines changed

13 files changed

+124
-66
lines changed

‎go.mod

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ require (
7070
github.com/mgechev/dots v0.0.0-20190921121421-c36f7dcfbb81
7171
github.com/mgechev/revive v1.0.3-0.20200921231451-246eac737dc7
7272
github.com/mholt/archiver/v3 v3.3.0
73-
github.com/microcosm-cc/bluemonday v1.0.5
73+
github.com/microcosm-cc/bluemonday v1.0.6
7474
github.com/minio/minio-go/v7 v7.0.4
7575
github.com/mitchellh/go-homedir v1.1.0
7676
github.com/msteinert/pam v0.0.0-20151204160544-02ccfbfaf0cc
@@ -105,7 +105,7 @@ require (
105105
go.jolheiser.com/hcaptcha v0.0.4
106106
go.jolheiser.com/pwn v0.0.3
107107
golang.org/x/crypto v0.0.0-20201217014255-9d1352758620
108-
golang.org/x/net v0.0.0-20210331212208-0fccb6fa2b5c
108+
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4
109109
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
110110
golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44
111111
golang.org/x/text v0.3.3
@@ -124,5 +124,3 @@ require (
124124
)
125125

126126
replace github.com/hashicorp/go-version => github.com/6543/go-version v1.2.4
127-
128-
replace github.com/microcosm-cc/bluemonday => github.com/lunny/bluemonday v1.0.5-0.20201227154428-ca34796141e8

‎go.sum

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,6 @@ github.com/bradfitz/gomemcache v0.0.0-20190329173943-551aad21a668 h1:U/lr3Dgy4WK
140140
github.com/bradfitz/gomemcache v0.0.0-20190329173943-551aad21a668/go.mod h1:H0wQNHz2YrLsuXOZozoeDmnHXkNCRmMW0gwFWDfEZDA=
141141
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
142142
github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
143-
github.com/chris-ramon/douceur v0.2.0 h1:IDMEdxlEUUBYBKE4z/mJnFyVXox+MjuEVDJNN27glkU=
144-
github.com/chris-ramon/douceur v0.2.0/go.mod h1:wDW5xjJdeoMm1mRt4sD4c/LbF/mWdEpRXQKjTR8nIBE=
145143
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
146144
github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
147145
github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
@@ -598,8 +596,6 @@ github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
598596
github.com/lib/pq v1.7.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
599597
github.com/lib/pq v1.8.1-0.20200908161135-083382b7e6fc h1:ERSU1OvZ6MdWhHieo2oT7xwR/HCksqKdgK6iYPU5pHI=
600598
github.com/lib/pq v1.8.1-0.20200908161135-083382b7e6fc/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
601-
github.com/lunny/bluemonday v1.0.5-0.20201227154428-ca34796141e8 h1:1omo92DLtxQu6VwVPSZAmduHaK5zssed6cvkHyl1XOg=
602-
github.com/lunny/bluemonday v1.0.5-0.20201227154428-ca34796141e8/go.mod h1:8iwZnFn2CDDNZ0r6UXhF4xawGvzaqzCRa1n3/lO3W2w=
603599
github.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:uNwtsDp7ci48vBTTxDuwcoTXz4lwtDTe7TjCQ0noaWY=
604600
github.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96/go.mod h1:mmIfjCSQlGYXmJ95jFN84AkQFnVABtKuJL8IrzwvUKQ=
605601
github.com/lunny/log v0.0.0-20160921050905-7887c61bf0de h1:nyxwRdWHAVxpFcDThedEgQ07DbcRc5xgNObtbTp76fk=
@@ -651,6 +647,8 @@ github.com/mgechev/revive v1.0.3-0.20200921231451-246eac737dc7 h1:ydVkpU/M4/c45y
651647
github.com/mgechev/revive v1.0.3-0.20200921231451-246eac737dc7/go.mod h1:no/hfevHbndpXR5CaJahkYCfM/FFpmM/dSOwFGU7Z1o=
652648
github.com/mholt/archiver/v3 v3.3.0 h1:vWjhY8SQp5yzM9P6OJ/eZEkmi3UAbRrxCq48MxjAzig=
653649
github.com/mholt/archiver/v3 v3.3.0/go.mod h1:YnQtqsp+94Rwd0D/rk5cnLrxusUBUXg+08Ebtr1Mqao=
650+
github.com/microcosm-cc/bluemonday v1.0.6 h1:ZOvqHKtnx0fUpnbQm3m3zKFWE+DRC+XB1onh8JoEObE=
651+
github.com/microcosm-cc/bluemonday v1.0.6/go.mod h1:HOT/6NaBlR0f9XlxD3zolN6Z3N8Lp4pvhp+jLS5ihnI=
654652
github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
655653
github.com/minio/md5-simd v1.1.0 h1:QPfiOqlZH+Cj9teu0t9b1nTBfPbyTl16Of5MeuShdK4=
656654
github.com/minio/md5-simd v1.1.0/go.mod h1:XpBqgZULrMYD3R+M28PcmP0CkI7PEMzB3U77ZrKZ0Gw=
@@ -996,8 +994,9 @@ golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/
996994
golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
997995
golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
998996
golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
999-
golang.org/x/net v0.0.0-20210331212208-0fccb6fa2b5c h1:KHUzaHIpjWVlVVNh65G3hhuj3KB1HnjY6Cq5cTvRQT8=
1000997
golang.org/x/net v0.0.0-20210331212208-0fccb6fa2b5c/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
998+
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4 h1:4nGaVu0QrbjT/AK2PRLuQfQuh6DJve+pELhqTdAj3x0=
999+
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
10011000
golang.org/x/oauth2 v0.0.0-20180620175406-ef147856a6dd/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
10021001
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
10031002
golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=

‎modules/markup/sanitizer.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,9 @@ func ReplaceSanitizer() {
4646
sanitizer.policy.AllowAttrs("checked", "disabled", "readonly").OnElements("input")
4747

4848
// Custom URL-Schemes
49-
sanitizer.policy.AllowURLSchemes(setting.Markdown.CustomURLSchemes...)
49+
if len(setting.Markdown.CustomURLSchemes) > 0 {
50+
sanitizer.policy.AllowURLSchemes(setting.Markdown.CustomURLSchemes...)
51+
}
5052

5153
// Allow keyword markup
5254
sanitizer.policy.AllowAttrs("class").Matching(regexp.MustCompile(`^` + keywordClass + `$`)).OnElements("span")

‎modules/markup/sanitizer_test.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
package markup
77

88
import (
9+
"html/template"
10+
"strings"
911
"testing"
1012

1113
"github.com/stretchr/testify/assert"
@@ -50,3 +52,13 @@ func Test_Sanitizer(t *testing.T) {
5052
assert.Equal(t, testCases[i+1], string(SanitizeBytes([]byte(testCases[i]))))
5153
}
5254
}
55+
56+
func TestSanitizeNonEscape(t *testing.T) {
57+
descStr := "<scrİpt>&lt;script&gt;alert(document.domain)&lt;/script&gt;</scrİpt>"
58+
59+
output := template.HTML(Sanitize(string(descStr)))
60+
if strings.Contains(string(output), "<script>") {
61+
t.Errorf("un-escaped <script> in output: %q", output)
62+
}
63+
64+
}

‎vendor/github.com/chris-ramon/douceur/parser/parser.go renamed to ‎vendor/github.com/aymerick/douceur/parser/parser.go

File renamed without changes.

‎vendor/github.com/chris-ramon/douceur/LICENSE

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎vendor/github.com/microcosm-cc/bluemonday/SECURITY.md

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/microcosm-cc/bluemonday/go.mod

Lines changed: 3 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/microcosm-cc/bluemonday/go.sum

Lines changed: 7 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/microcosm-cc/bluemonday/handlers.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/microcosm-cc/bluemonday/policy.go

Lines changed: 28 additions & 15 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/microcosm-cc/bluemonday/sanitize.go

Lines changed: 46 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/modules.txt

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ github.com/anmitsu/go-shlex
103103
github.com/asaskevich/govalidator
104104
# github.com/aymerick/douceur v0.2.0
105105
github.com/aymerick/douceur/css
106+
github.com/aymerick/douceur/parser
106107
# github.com/beorn7/perks v1.0.1
107108
github.com/beorn7/perks/quantile
108109
# github.com/blevesearch/bleve v1.0.10
@@ -169,8 +170,6 @@ github.com/boombuler/barcode/qr
169170
github.com/boombuler/barcode/utils
170171
# github.com/bradfitz/gomemcache v0.0.0-20190329173943-551aad21a668
171172
github.com/bradfitz/gomemcache/memcache
172-
# github.com/chris-ramon/douceur v0.2.0
173-
github.com/chris-ramon/douceur/parser
174173
# github.com/couchbase/gomemcached v0.0.0-20191004160342-7b5da2ec40b2
175174
## explicit
176175
github.com/couchbase/gomemcached
@@ -566,7 +565,7 @@ github.com/mgechev/revive/rule
566565
# github.com/mholt/archiver/v3 v3.3.0
567566
## explicit
568567
github.com/mholt/archiver/v3
569-
# github.com/microcosm-cc/bluemonday v1.0.5 => github.com/lunny/bluemonday v1.0.5-0.20201227154428-ca34796141e8
568+
# github.com/microcosm-cc/bluemonday v1.0.6
570569
## explicit
571570
github.com/microcosm-cc/bluemonday
572571
# github.com/minio/md5-simd v1.1.0
@@ -809,7 +808,7 @@ golang.org/x/crypto/ssh/knownhosts
809808
# golang.org/x/mod v0.3.0
810809
golang.org/x/mod/module
811810
golang.org/x/mod/semver
812-
# golang.org/x/net v0.0.0-20210331212208-0fccb6fa2b5c
811+
# golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4
813812
## explicit
814813
golang.org/x/net/context
815814
golang.org/x/net/context/ctxhttp
@@ -979,4 +978,3 @@ xorm.io/xorm/names
979978
xorm.io/xorm/schemas
980979
xorm.io/xorm/tags
981980
# github.com/hashicorp/go-version => github.com/6543/go-version v1.2.4
982-
# github.com/microcosm-cc/bluemonday => github.com/lunny/bluemonday v1.0.5-0.20201227154428-ca34796141e8

0 commit comments

Comments
 (0)