14 commits

Author	SHA1	Message	Date
Earl Warren	1075ff74b5	Use restricted sanitizer for repository description (#28141) ... - Currently the repository description uses the same sanitizer as a normal markdown document. This means that element such as heading and images are allowed and can be abused. - Create a minimal restricted sanitizer for the repository description, which only allows what the postprocessor currently allows, which are links and emojis. - Added unit testing. - Resolves https://codeberg.org/forgejo/forgejo/issues/1202 - Resolves https://codeberg.org/Codeberg/Community/issues/1122 (cherry picked from commit 631c87cc23) Co-authored-by: Gusted <postmaster@gusted.xyz>	2023-11-23 16:34:25 +00:00
Earl Warren	eaea530d6b	Render plaintext task list items for markdown files (#26186) ... - The library that's being used for org-mode, [doesn't render the status of list items](https://github.com/niklasfasching/go-org/issues/63). - Add a modified version of the proposed CSS snippet to still display the status for the list items. The alternative was parsing HTML and transforming it, which is too complicated for this small task. - Resolves https://codeberg.org/Codeberg/Community/issues/1099 (cherry picked from commit 9753c7e4b8) Refs: https://codeberg.org/forgejo/forgejo/pulls/1071 Co-authored-by: Gusted <postmaster@gusted.xyz>	2023-07-27 14:15:31 +00:00
KN4CK3R	8af96f585f	Disallow dangerous url schemes (#25960) ... Regression: https://github.com/go-gitea/gitea/pull/24805 Closes: #25945 - Disallow `javascript`, `vbscript` and `data` (data uri images still work) url schemes even if all other schemes are allowed - Fixed older `cbthunderlink` tests --------- Co-authored-by: delvh <dev.lh@web.de>	2023-07-18 15:18:37 +00:00
Yarden Shoham	f5ce2ed292	Allow all URL schemes in Markdown links by default (#24805) ... - Closes #21146 - Closes #16721 ## ⚠️ BREAKING ⚠️ This changes the default behavior to now create links for any URL scheme when the user uses the markdown form for links (`[label](URL)`), this doesn't affect the rendering of inline links. To opt-out set the `markdown.CUSTOM_URL_SCHEMES` setting to a list of allowed schemes, all other schemes (except `http` and `https`) won't be allowed. # Before  # After  --------- Signed-off-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: Giteabot <teabot@gitea.io>	2023-05-19 17:17:07 +02:00
flynnnnnnnnnn	e81ccc406b	Implement FSFE REUSE for golang files (#21840) ... Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>	2022-11-27 18:20:29 +00:00
Gusted	edd945bca3	Allow to specify colors for text in markup (#20363) ... `<span style="color: red">Hello World!</span>` will now be accepted by Bluemonday, other properties are still disallowed by Bluemonday.	2022-07-15 14:38:10 +08:00
Wim	cb50375e2b	Add more linters to improve code readability (#19989) ... Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability - nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length. - unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions - wastedassign - https://github.com/sanposhiho/wastedassign - wastedassign finds wasted assignment statements. - notlintlint - Reports ill-formed or insufficient nolint directives - stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)	2022-06-20 12:02:49 +02:00
6543	54e9ee37a7	format with gofumpt (#18184) ... * gofumpt -w -l . * gofumpt -w -l -extra . * Add linter * manual fix * change make fmt	2022-01-20 18:46:10 +01:00
KN4CK3R	21cde5c439	Fix data URI scramble (#16098) ... * Removed unused method. * No prefix for data uris. * Added test to prevent regressions.	2021-06-07 18:55:26 +02:00
zeripath	04196b7658	Update to bluemonday-1.0.6 (#15294) ... Signed-off-by: Andrew Thornton <art27@cantab.net>	2021-04-05 17:38:31 -04:00
silverwind	41e8b834af	Markdown task list improvements (#13952) ... * Markdown task list improvements - Remove `.ui` class and wrappers to prevent fomantic from messing with it. - Change rendered HTML to match GitHub. - Add custom styling for the checkboxes. * fix unittest Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: techknowlogick <techknowlogick@gitea.io>	2020-12-13 09:05:50 +08:00
zeripath	ce66ca7f9f	Restore checkbox rendering and prevent poor sanitization of spans (#11277) ... * Add test Signed-off-by: Andrew Thornton <art27@cantab.net> * Restore checkbox rendering and prevent poor sanitization of spans Signed-off-by: Andrew Thornton <art27@cantab.net> * Also fix preview context Signed-off-by: Andrew Thornton <art27@cantab.net> * Also fix preview context Signed-off-by: Andrew Thornton <art27@cantab.net>	2020-05-03 17:17:24 -03:00
John Olheiser	9a33adcdd3	Allow kbd tags (#9245) ... * Allow kbd tags Signed-off-by: jolheiser <john.olheiser@gmail.com> * Add test Signed-off-by: jolheiser <john.olheiser@gmail.com>	2019-12-03 14:02:41 -05:00
Lunny Xiao	52e11b24bf	Restructure markup & markdown to prepare for multiple markup language… (#2411) ... * restructure markup & markdown to prepare for multiple markup languages support * adjust some functions between markdown and markup * fix tests * improve the comments	2017-09-16 20:17:57 +03:00

Renamed from modules/markdown/sanitizer_test.go (Browse further)