From 00698da1752e0894c384ac4eb1caee8e71004542 Mon Sep 17 00:00:00 2001 From: Michael Matloob Date: Wed, 6 Dec 2023 10:03:52 -0500 Subject: [PATCH] internal/frontend: replace bluemonday with the simple sanitizer The simple sanitizer has very few diffs compared to bluemonday and they're all accounted for. For #61399 Change-Id: Ib22b5828e8c1073a6fe3c2f87eee658eda3165a0 Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/547875 kokoro-CI: kokoro LUCI-TryBot-Result: Go LUCI Reviewed-by: Jonathan Amsterdam --- go.mod | 3 --- go.sum | 6 ------ internal/frontend/readme.go | 18 +++--------------- 3 files changed, 3 insertions(+), 24 deletions(-) diff --git a/go.mod b/go.mod index f8a08a088..cd6727f57 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,6 @@ require ( github.com/jackc/pgx/v4 v4.14.1 github.com/jba/templatecheck v0.6.0 github.com/lib/pq v1.10.9 - github.com/microcosm-cc/bluemonday v1.0.25 github.com/russross/blackfriday/v2 v2.1.0 github.com/yuin/goldmark v1.4.13 github.com/yuin/goldmark-emoji v1.0.1 @@ -55,7 +54,6 @@ require ( cloud.google.com/go/trace v1.9.0 // indirect github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect github.com/aws/aws-sdk-go v1.34.29 // indirect - github.com/aymerick/douceur v0.2.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect github.com/cespare/xxhash/v2 v2.2.0 // indirect @@ -68,7 +66,6 @@ require ( github.com/google/uuid v1.3.0 // indirect github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect github.com/googleapis/gax-go/v2 v2.11.0 // indirect - github.com/gorilla/css v1.0.0 // indirect github.com/hashicorp/errwrap v1.0.0 // indirect github.com/hashicorp/go-multierror v1.1.0 // indirect github.com/jackc/chunkreader/v2 v2.0.1 // indirect diff --git a/go.sum b/go.sum index b355ba6d3..bf6c6e788 100644 --- a/go.sum +++ b/go.sum @@ -180,8 +180,6 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.6.1/go.mod h1:hLZ/AnkIKHLuPGjEiyghNE github.com/aws/aws-sdk-go-v2/service/sts v1.7.2/go.mod h1:8EzeIqfWt2wWT4rJVu3f21TfrhJ8AEMzVybRNSb/b4g= github.com/aws/smithy-go v1.7.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E= github.com/aws/smithy-go v1.8.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E= -github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk= -github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4= github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= @@ -600,8 +598,6 @@ github.com/googleapis/gax-go/v2 v2.11.0 h1:9V9PWXEsWnPpQhu/PeQIkS4eGzMlTLGgt80cU github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI= github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= -github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY= -github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c= github.com/gorilla/handlers v0.0.0-20150720190736-60c7bfde3e33/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ= github.com/gorilla/handlers v1.4.2/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ= github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs= @@ -801,8 +797,6 @@ github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 h1:I0XW9+e1XWDxdcEniV4rQAIOPUGDq67JSCiRCgGCZLI= github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4= -github.com/microcosm-cc/bluemonday v1.0.25 h1:4NEwSfiJ+Wva0VxN5B8OwMicaJvD8r9tlJWm9rtloEg= -github.com/microcosm-cc/bluemonday v1.0.25/go.mod h1:ZIOjCQp1OrzBBPIJmfX4qDYFuhU02nx4bn030ixfHLE= github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs= github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4= github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= diff --git a/internal/frontend/readme.go b/internal/frontend/readme.go index a54211e23..670985588 100644 --- a/internal/frontend/readme.go +++ b/internal/frontend/readme.go @@ -11,7 +11,6 @@ import ( "github.com/google/safehtml" "github.com/google/safehtml/template" "github.com/google/safehtml/uncheckedconversions" - "github.com/microcosm-cc/bluemonday" "github.com/yuin/goldmark" emoji "github.com/yuin/goldmark-emoji" "github.com/yuin/goldmark/extension" @@ -23,6 +22,7 @@ import ( "golang.org/x/pkgsite/internal" "golang.org/x/pkgsite/internal/derrors" "golang.org/x/pkgsite/internal/log" + "golang.org/x/pkgsite/internal/sanitizer" "golang.org/x/pkgsite/internal/source" ) @@ -112,7 +112,7 @@ func processReadme(ctx context.Context, readme *internal.Readme, sourceInfo *sou ), ), // These extensions lets users write HTML code in the README. This is - // fine since we process the contents using bluemonday after. + // fine since we process the contents using the sanitizer after. goldmark.WithRendererOptions(goldmarkHtml.WithUnsafe(), goldmarkHtml.WithXHTML()), goldmark.WithExtensions( extension.GFM, // Support Github Flavored Markdown. @@ -159,18 +159,6 @@ func processReadme(ctx context.Context, readme *internal.Readme, sourceInfo *sou // sanitizeHTML sanitizes HTML from a bytes.Buffer so that it is safe. func sanitizeHTML(b *bytes.Buffer) safehtml.HTML { - p := bluemonday.UGCPolicy() - - p.AllowAttrs("width", "align").OnElements("img") - p.AllowAttrs("width", "align").OnElements("div") - p.AllowAttrs("width", "align").OnElements("p") - // Allow accessible headings (i.e
). - p.AllowAttrs("width", "align", "role", "aria-level").OnElements("div") - for _, h := range []string{"h1", "h2", "h3", "h4", "h5", "h6"} { - // Needed to preserve github styles heading font-sizes - p.AllowAttrs("class").OnElements(h) - } - - s := string(p.SanitizeBytes(b.Bytes())) + s := string(sanitizer.SanitizeBytes(b.Bytes())) return uncheckedconversions.HTMLFromStringKnownToSatisfyTypeContract(s) }