Skip to content

Commit fb42972

Browse files
wxiaoguangwxiaoguang
authored
Rename Str2html to SanitizeHTML and clarify its behavior (#29516)
Str2html was abused a lot. So use a proper name for it: SanitizeHTML And add some tests to show its behavior.
1 parent cb52b17 commit fb42972

File tree

14 files changed

+48
-43
lines changed

14 files changed

+48
-43
lines changed

‎docs/content/administration/mail-templates.en-us.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,7 @@ Please check [Gitea's logs](administration/logging-config.md) for error messages
224224
{{if not (eq .Body "")}}
225225
<h3>Message content</h3>
226226
<hr>
227-
{{.Body | Str2html}}
227+
{{.Body | SanitizeHTML}}
228228
{{end}}
229229
</p>
230230
<hr>
@@ -260,19 +260,19 @@ The template system contains several functions that can be used to further proce
260260
the messages. Here's a list of some of them:
261261

262262
| Name | Parameters | Available | Usage |
263-
| ---------------- | ----------- | --------- | --------------------------------------------------------------------------- |
263+
| ---------------- | ----------- | --------- |-----------------------------------------------------------------------------|
264264
| `AppUrl` | - | Any | Gitea's URL |
265265
| `AppName` | - | Any | Set from `app.ini`, usually "Gitea" |
266266
| `AppDomain` | - | Any | Gitea's host name |
267267
| `EllipsisString` | string, int | Any | Truncates a string to the specified length; adds ellipsis as needed |
268-
| `Str2html` | string | Body only | Sanitizes text by removing any HTML tags from it. |
268+
| `SanitizeHTML` | string | Body only | Sanitizes text by removing any dangerous HTML tags from it. |
269269
| `SafeHTML` | string | Body only | Takes the input as HTML; can be used for `.ReviewComments.RenderedContent`. |
270270

271271
These are _functions_, not metadata, so they have to be used:
272272

273273
```html
274-
Like this: {{Str2html "Escape<my>text"}}
275-
Or this: {{"Escape<my>text" | Str2html}}
274+
Like this: {{SanitizeHTML "Escape<my>text"}}
275+
Or this: {{"Escape<my>text" | SanitizeHTML}}
276276
Or this: {{AppUrl}}
277277
But not like this: {{.AppUrl}}
278278
```

‎docs/content/administration/mail-templates.zh-cn.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ _主题_ 和 _邮件正文_ 由 [Golang的模板引擎](https://go.dev/pkg/text/
207207
{{if not (eq .Body "")}}
208208
<h3>消息内容：</h3>
209209
<hr>
210-
{{.Body | Str2html}}
210+
{{.Body | SanitizeHTML}}
211211
{{end}}
212212
</p>
213213
<hr>
@@ -242,20 +242,20 @@ _主题_ 和 _邮件正文_ 由 [Golang的模板引擎](https://go.dev/pkg/text/
242242

243243
模板系统包含一些函数，可用于进一步处理和格式化消息。以下是其中一些函数的列表：
244244

245-
| 函数名 | 参数 | 可用于 | 用法 |
246-
|------------------| ----------- | ------------ | --------------------------------------------------------------------------------- |
247-
| `AppUrl` | - | 任何地方 | Gitea 的 URL |
248-
| `AppName` | - | 任何地方 | 从 `app.ini` 中设置，通常为 "Gitea" |
249-
| `AppDomain` | - | 任何地方 | Gitea 的主机名 |
250-
| `EllipsisString` | string, int | 任何地方 | 将字符串截断为指定长度；根据需要添加省略号 |
251-
| `Str2html` | string | 仅正文部分 | 通过删除其中的 HTML 标签对文本进行清理 |
252-
| `SafeHTML` | string | 仅正文部分 | 将输入作为 HTML 处理；可用于 `.ReviewComments.RenderedContent` 等字段 |
245+
| 函数名 | 参数 | 可用于 | 用法 |
246+
|------------------| ----------- | ------------ |---------------------------------------------------------|
247+
| `AppUrl` | - | 任何地方 | Gitea 的 URL |
248+
| `AppName` | - | 任何地方 | 从 `app.ini` 中设置，通常为 "Gitea" |
249+
| `AppDomain` | - | 任何地方 | Gitea 的主机名 |
250+
| `EllipsisString` | string, int | 任何地方 | 将字符串截断为指定长度；根据需要添加省略号 |
251+
| `SanitizeHTML` | string | 仅正文部分 | 通过删除其中的危险 HTML 标签对文本进行清理 |
252+
| `SafeHTML` | string | 仅正文部分 | 将输入作为 HTML 处理；可用于 `.ReviewComments.RenderedContent` 等字段 |
253253

254254
这些都是 _函数_，而不是元数据，因此必须按以下方式使用：
255255

256256
```html
257-
像这样使用： {{Str2html "Escape<my>text"}}
258-
或者这样使用： {{"Escape<my>text" | Str2html}}
257+
像这样使用： {{SanitizeHTML "Escape<my>text"}}
258+
或者这样使用： {{"Escape<my>text" | SanitizeHTML}}
259259
或者这样使用： {{AppUrl}}
260260
但不要像这样使用： {{.AppUrl}}
261261
```

‎modules/templates/helper.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,16 +33,16 @@ func NewFuncMap() template.FuncMap {
3333

3434
// -----------------------------------------------------------------
3535
// html/template related functions
36-
"dict": dict, // it's lowercase because this name has been widely used. Our other functions should have uppercase names.
37-
"Eval": Eval,
38-
"SafeHTML": SafeHTML,
39-
"HTMLFormat": HTMLFormat,
40-
"HTMLEscape": HTMLEscape,
41-
"QueryEscape": url.QueryEscape,
42-
"JSEscape": JSEscapeSafe,
43-
"Str2html": Str2html, // TODO: rename it to SanitizeHTML
44-
"URLJoin": util.URLJoin,
45-
"DotEscape": DotEscape,
36+
"dict": dict, // it's lowercase because this name has been widely used. Our other functions should have uppercase names.
37+
"Eval": Eval,
38+
"SafeHTML": SafeHTML,
39+
"HTMLFormat": HTMLFormat,
40+
"HTMLEscape": HTMLEscape,
41+
"QueryEscape": url.QueryEscape,
42+
"JSEscape": JSEscapeSafe,
43+
"SanitizeHTML": SanitizeHTML,
44+
"URLJoin": util.URLJoin,
45+
"DotEscape": DotEscape,
4646

4747
"PathEscape": url.PathEscape,
4848
"PathEscapeSegments": util.PathEscapeSegments,
@@ -207,8 +207,8 @@ func SafeHTML(s any) template.HTML {
207207
panic(fmt.Sprintf("unexpected type %T", s))
208208
}
209209

210-
// Str2html sanitizes the input by pre-defined markdown rules
211-
func Str2html(s any) template.HTML {
210+
// SanitizeHTML sanitizes the input by pre-defined markdown rules
211+
func SanitizeHTML(s any) template.HTML {
212212
switch v := s.(type) {
213213
case string:
214214
return template.HTML(markup.Sanitize(v))

‎modules/templates/helper_test.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,8 @@ func TestJSEscapeSafe(t *testing.T) {
6161
func TestHTMLFormat(t *testing.T) {
6262
assert.Equal(t, template.HTML("<a>&lt; < 1</a>"), HTMLFormat("<a>%s %s %d</a>", "<", template.HTML("<"), 1))
6363
}
64+
65+
func TestSanitizeHTML(t *testing.T) {
66+
assert.Equal(t, template.HTML(`<a href="/" rel="nofollow">link</a> xss <div>inline</div>`), SanitizeHTML(`<a href="/">link</a> <a href="javascript:">xss</a> <div style="dangerous">inline</div>`))
67+
assert.Equal(t, template.HTML(`<a href="/" rel="nofollow">link</a> xss <div>inline</div>`), SanitizeHTML(template.HTML(`<a href="/">link</a> <a href="javascript:">xss</a> <div style="dangerous">inline</div>`)))
68+
}

‎routers/web/feed/convert.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ func renderMarkdown(ctx *context.Context, act *activities_model.Action, content
6464
}
6565
markdown, err := markdown.RenderString(markdownCtx, content)
6666
if err != nil {
67-
return templates.Str2html(content) // old code did so: use Str2html to render in tmpl
67+
return templates.SanitizeHTML(content) // old code did so: use SanitizeHTML to render in tmpl
6868
}
6969
return markdown
7070
}
@@ -243,7 +243,7 @@ func feedActionsToFeedItems(ctx *context.Context, actions activities_model.Actio
243243
}
244244
}
245245
if len(content) == 0 {
246-
content = templates.Str2html(desc)
246+
content = templates.SanitizeHTML(desc)
247247
}
248248

249249
items = append(items, &feeds.Item{

‎routers/web/org/projects.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ func Projects(ctx *context.Context) {
105105
}
106106

107107
for _, project := range projects {
108-
project.RenderedContent = templates.Str2html(project.Description) // FIXME: is it right? why not render?
108+
project.RenderedContent = templates.SanitizeHTML(project.Description) // FIXME: is it right? why not render?
109109
}
110110

111111
err = shared_user.LoadHeaderCount(ctx)
@@ -396,7 +396,7 @@ func ViewProject(ctx *context.Context) {
396396
}
397397
}
398398

399-
project.RenderedContent = templates.Str2html(project.Description) // FIXME: is it right? why not render?
399+
project.RenderedContent = templates.SanitizeHTML(project.Description) // FIXME: is it right? why not render?
400400
ctx.Data["LinkedPRs"] = linkedPrsMap
401401
ctx.Data["PageIsViewProjects"] = true
402402
ctx.Data["CanWriteProjects"] = canWriteProjects(ctx)

‎routers/web/repo/issue.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1761,7 +1761,7 @@ func ViewIssue(ctx *context.Context) {
17611761
// so "|" is used as delimeter to mark the new format
17621762
if comment.Content[0] != '|' {
17631763
// handle old time comments that have formatted text stored
1764-
comment.RenderedContent = templates.Str2html(comment.Content)
1764+
comment.RenderedContent = templates.SanitizeHTML(comment.Content)
17651765
comment.Content = ""
17661766
} else {
17671767
// else it's just a duration in seconds to pass on to the frontend

‎templates/base/alert.tmpl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
{{if .Flash.ErrorMsg}}
22
<div class="ui negative message flash-message flash-error">
3-
<p>{{.Flash.ErrorMsg | Str2html}}</p>
3+
<p>{{.Flash.ErrorMsg | SanitizeHTML}}</p>
44
</div>
55
{{end}}
66
{{if .Flash.SuccessMsg}}
77
<div class="ui positive message flash-message flash-success">
8-
<p>{{.Flash.SuccessMsg | Str2html}}</p>
8+
<p>{{.Flash.SuccessMsg | SanitizeHTML}}</p>
99
</div>
1010
{{end}}
1111
{{if .Flash.InfoMsg}}
1212
<div class="ui info message flash-message flash-info">
13-
<p>{{.Flash.InfoMsg | Str2html}}</p>
13+
<p>{{.Flash.InfoMsg | SanitizeHTML}}</p>
1414
</div>
1515
{{end}}
1616
{{if .Flash.WarningMsg}}
1717
<div class="ui warning message flash-message flash-warning">
18-
<p>{{.Flash.WarningMsg | Str2html}}</p>
18+
<p>{{.Flash.WarningMsg | SanitizeHTML}}</p>
1919
</div>
2020
{{end}}

‎templates/base/alert_details.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22
<details>
33
<summary>{{.Summary}}</summary>
44
<code>
5-
{{.Details | Str2html}}
5+
{{.Details | SanitizeHTML}}
66
</code>
77
</details>

‎templates/mail/issue/default.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@
5858
{{.locale.Tr "mail.issue.action.new" .Doer.Name .Issue.Index}}
5959
{{end}}
6060
{{else}}
61-
{{.Body | Str2html}}
61+
{{.Body | SanitizeHTML}}
6262
{{end -}}
6363
{{- range .ReviewComments}}
6464
<hr>

‎templates/repo/commit_page.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@
276276
<span class="text grey" id="note-authored-time">{{TimeSince .NoteCommit.Author.When ctx.Locale}}</span>
277277
</div>
278278
<div class="ui bottom attached info segment git-notes">
279-
<pre class="commit-body">{{.NoteRendered | Str2html}}</pre>
279+
<pre class="commit-body">{{.NoteRendered | SanitizeHTML}}</pre>
280280
</div>
281281
{{end}}
282282
{{template "repo/diff/box" .}}

‎templates/repo/issue/view_content/comments.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@
162162
</span>
163163
<div class="detail">
164164
{{svg "octicon-git-commit"}}
165-
<span class="text grey muted-links">{{.Content | Str2html}}</span>
165+
<span class="text grey muted-links">{{.Content | SanitizeHTML}}</span>
166166
</div>
167167
</div>
168168
{{else if eq .Type 7}}

‎templates/repo/settings/webhook/base_list.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<div class="ui attached segment">
1111
<div class="ui list">
1212
<div class="item">
13-
{{.Description | Str2html}}
13+
{{.Description | SanitizeHTML}}
1414
</div>
1515
{{range .Webhooks}}
1616
<div class="item truncated-item-container">

‎templates/status/500.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{/* This page should only depend the minimal template functions/variables, to avoid triggering new panics.
2-
* base template functions: AppName, AssetUrlPrefix, AssetVersion, AppSubUrl, ThemeName, Str2html
2+
* base template functions: AppName, AssetUrlPrefix, AssetVersion, AppSubUrl, ThemeName, SanitizeHTML
33
* ctx.Locale
44
* .Flash
55
* .ErrorMsg

0 commit comments

Comments
 (0)