Commit graph

17 commits

Author SHA1 Message Date
Philip How
2129ae145b
Update style for new reply email (#20861)
* update style for new reply email

* Truncate and sanitize comment

* rubocop

* fix links, fix stop send when no content
2024-04-19 08:56:16 -04:00
Daniel Uber
a052b16015
Don't sanitize anchor elements with no href (#16667)
* If href is nil, allow node

* Add unit test showing no change

My first pass had the `<a>` within an h1 content, but the scrubber
added a newline after the closing a tag?
2022-02-22 11:27:38 -06:00
Ryan Palo
40639ea602
Fix RSS feed validity issue (#16418) (#16517) 2022-02-22 09:22:05 -06:00
Jeremy Friesen
aa7712a80e
Extracting container for allowed tags & attrs (#15338)
* Extracting container for allowed tags & attrs

Prior to this commit, we had several different locations in which we
specified ALLOWED_TAGS and ALLOWED_ATTRIBUTES for HTML rendering and
sanitization.

Curious to see how these either intersected or didn't, I opted to
create a container module that allows for us to more readily normalize
these allowed tags and attributes.  It's possible that we won't do any
normalization, but this work helps make that easier.

Ideally, I'd love us to contextualize "why did we choose the
tags/attributes we chose?"  But for now, I think consolidating these
tags and attributes will help make adding a `details` and `summary` tag
easier.

This relates to forem/rfcs#296

See [Google Sheet][1] for analysis of what tags/attributes are used, the
intersection and union.

[1]:https://docs.google.com/spreadsheets/d/1yj-a1qus1o0o4cj-_gOMP5yteeg-_f3s5z7kvK0Y7RM/edit#gid=0

* Fixing misnamed constant

* Fixing misnamed constant

* Extracting additional HtmlRendering use cases

* Adding comparative documentation for HTML tags

* Fixing broken parameter signature

* Moving constants into MarkdownProcessor
2021-12-16 12:24:45 -05:00
Michael Kohl
c16ec1d53d
Remove redundant freeze calls (#14596) 2021-08-26 10:01:08 -04:00
Mac Siri
443e852091
Remove button from allowed tags (#14434) 2021-08-11 10:48:07 -04:00
Andy Zhao
dc30eadad8
Remove unused attributes from markdown parser (#13484)
* Remove definitely unused attributes

* Refactor and remove unused attributes

* Add parentheses

* Prevent alt tag from having Liquid tags inside

* Add test

* Remove more unused attributes

* Scrub any valid attributes

* Remove unused tags and add more tests

* Remove <i> tag; <em> is used by parser

* Remove <center> b/c it's deprecated though still valid

* <cite> is a safe tag and used by some

* Eh I changed my mind about center lol

* Add underline <u> back in

* Don't allow width changes

* Use frozen constant for regex

* Use #remove over #gsub
2021-04-27 09:33:01 -04:00
Jacob Herrington
514b06afd4
Remove unused code (#13305) 2021-04-08 08:50:59 -05:00
Jacob Herrington
f76a8e1e99
[15-minute fix] Don't allow markdown to use CSS classes (#13282)
* Don't allow markdown to use CSS classes

* Fix code highlighting

* Add spec for ignoring CSS classes

* Add comment
2021-04-07 11:40:39 -04:00
ludwiczakpawel
6b0505dc47
Video max width (#12436)
* tooltips 1.0.1

* tooltips 1.0.1

* video width

* addding  to supported attributes for markdown scrubber
2021-01-26 15:12:37 +01:00
rhymes
5b62811c98
[deploy] Rubocop: fix violations of Layout/LineLength (#9197) 2020-07-08 08:36:36 -05:00
Bolarinwa Balogun
18d061a714 Add support for mark element in markdown (#2089) 2019-03-18 17:10:58 -04:00
Keshav Biswa
8d57d45ecc Rubocop Style cops enabled (#2056)
* Rubocop enabled style/alias

* Enabled Style/ArrayJoin Cop

* Enabled Style/Attr

* Enabled Case Equality

* Enabled CharacterLiteral

*  Enabled ColonMethodCall Cop

* Enabled CommentAnnotation cop

* Enabled PreferredHashMethods Cop

*  Enabled DoubleNegation Cop

* Enabled EachWithObject Cop

* Enabled EmptyLiteral Cop

* Enabled EvenOdd Cop

* Enabled IfWithSemicolon Cop

* Enabled Lambda and LambdaCall Cop

* Enabled LineEndConcatenation Cop

* Enabled ModuleFunction Cop;

* Enable NegatedIf and NegatedWhile Cop

* Enabled NilComparison Cop

* Enabled Not Cop

* Enabled NumericLiterals Cop

* Enabled OneLineConditional Cop

* Enabled PercentLiteralDelimiters Cop

* Excluded internal/users_controller from negated_if cop

* Reverted the double negation change from github_issue_tag and github_issue.rb"

* Enabled PerlBackrefs Cop

* Changed Regexp.last_match(1) to Regexp.last_match(0)

* Enabled proc cop

* Enabled RaiseArgs Cop

* Reverted Regexp.last_match(0) to Regexp.last_match(1)

* Enabled SelfAssignment Cop

* Enabled SingleLineMethods Cop

* Enabled SpecialGlobalVars Cop

* Enabled VariableInterpolation Cop

* Enabled WhenThen Cop

* Enabled WhileUntilModifier Cop

* Enabled WordArray Cop

* Enabled IfUnlessModifier Cop

* Enabled GuardClause Cop
2019-03-15 18:33:54 -04:00
Carl Saunders
c1eecd1850 Added <kbd> tag support to markdown editors in article posts and comm… (#1761)
* Added <kbd> tag support to markdown editors in article posts and comments.

* Fixed typo in test.

* Fixed test - now compares against inner html.

* Removed .showpage-signi-cta as dead code was reinstated accidentally via git merge.

* Use sass placeholder as no need to output the .kbd class in the css.

* Reinstated original css as accidentally changed with merge.
2019-02-16 22:30:35 -04:00
Andy Zhao
2ac05b4c9b Use safe navigation for edge cases (#1632) 2019-01-23 15:31:15 -05:00
Benny Powers
9c840030f1 Feature/more markdown tags (#826)
* Add aside and abbr tags to markdown whitelist

* Permits abbr and aside when scrubbing rendered markdown
2018-10-04 19:02:55 -04:00
Andy Zhao
c9c02ef3c0 [Done] Fix div in li issue (#320)
* Lint and clean up github issue styles

* Use heredoc HTML for easier formatting

* Add better error handling for 404 github issues

* Use custom sanitizer for markdown render

* Refactor unless to ternary

* Rename file and tighten up sanitization

* Fix codepen and instagram tag styling
2018-05-21 17:35:03 -04:00