thepaperpilot/forgejo
1
0
Fork 0
Code Issues Pull requests Releases Activity Actions
16631 commits 49 branches 198 tags 596 MiB
Commit graph

14 commits

Author SHA1 Message Date
Gusted
80e05a8245
[GITEA] Use restricted sanitizer for repository description 
- Currently the repository description uses the same sanitizer as a
normal markdown document. This means that element such as heading and
images are allowed and can be abused.
- Create a minimal restricted sanitizer for the repository description,
which only allows what the postprocessor currently allows, which are
links and emojis.
- Added unit testing.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1202
- Resolves https://codeberg.org/Codeberg/Community/issues/1122

(cherry picked from commit a8afa4cd18)
(cherry picked from commit 0238587c51)
(cherry picked from commit a8c7bbf728)
 2023-10-02 19:23:42 +02:00
Earl Warren
eaea530d6b
Render plaintext task list items for markdown files (#26186) 
- The library that's being used for org-mode, [doesn't render the status
of list items](https://github.com/niklasfasching/go-org/issues/63).
- Add a modified version of the proposed CSS snippet to still display
the status for the list items. The alternative was parsing HTML and
transforming it, which is too complicated for this small task.
- Resolves https://codeberg.org/Codeberg/Community/issues/1099

(cherry picked from commit 9753c7e4b8)

Refs: https://codeberg.org/forgejo/forgejo/pulls/1071

Co-authored-by: Gusted <postmaster@gusted.xyz>
 2023-07-27 14:15:31 +00:00
KN4CK3R
8af96f585f
Disallow dangerous url schemes (#25960) 
Regression: https://github.com/go-gitea/gitea/pull/24805
Closes: #25945

- Disallow `javascript`, `vbscript` and `data` (data uri images still
work) url schemes even if all other schemes are allowed
- Fixed older `cbthunderlink` tests

---------

Co-authored-by: delvh <dev.lh@web.de>
 2023-07-18 15:18:37 +00:00
Yarden Shoham
f5ce2ed292
Allow all URL schemes in Markdown links by default (#24805) 
- Closes #21146
- Closes #16721

## ⚠️ BREAKING ⚠️
This changes the default behavior to now create links for any URL scheme
when the user uses the markdown form for links (`[label](URL)`), this
doesn't affect the rendering of inline links. To opt-out set the
`markdown.CUSTOM_URL_SCHEMES` setting to a list of allowed schemes, all
other schemes (except `http` and `https`) won't be allowed.

# Before

![image](https://github.com/go-gitea/gitea/assets/20454870/35fa18ce-7dda-4995-b5b3-3f360f38296d)

# After

![image](https://github.com/go-gitea/gitea/assets/20454870/0922216b-0b35-4b77-9919-21a5c21dd5d0)

---------

Signed-off-by: Yarden Shoham <git@yardenshoham.com>
Co-authored-by: Giteabot <teabot@gitea.io>
 2023-05-19 17:17:07 +02:00
flynnnnnnnnnn
e81ccc406b
Implement FSFE REUSE for golang files (#21840) 
Change all license headers to comply with REUSE specification.

Fix #16132

Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
 2022-11-27 18:20:29 +00:00
Gusted
edd945bca3
Allow to specify colors for text in markup (#20363) 
`<span style="color: red">Hello World!</span>` will now be accepted by
Bluemonday, other properties are still disallowed by Bluemonday.
 2022-07-15 14:38:10 +08:00
Wim
cb50375e2b
Add more linters to improve code readability (#19989) 
Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability

- nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length.
- unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions
- wastedassign - https://github.com/sanposhiho/wastedassign -  wastedassign finds wasted assignment statements.
- notlintlint -  Reports ill-formed or insufficient nolint directives
- stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent
  - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)
 2022-06-20 12:02:49 +02:00
6543
54e9ee37a7
format with gofumpt (#18184) 
* gofumpt -w -l .

* gofumpt -w -l -extra .

* Add linter

* manual fix

* change make fmt
 2022-01-20 18:46:10 +01:00
KN4CK3R
21cde5c439
Fix data URI scramble (#16098) 
* Removed unused method.

* No prefix for data uris.

* Added test to prevent regressions.
 2021-06-07 18:55:26 +02:00
zeripath
04196b7658
Update to bluemonday-1.0.6 (#15294) 
Signed-off-by: Andrew Thornton <art27@cantab.net>
 2021-04-05 17:38:31 -04:00
silverwind
41e8b834af
Markdown task list improvements (#13952) 
* Markdown task list improvements

- Remove `.ui` class and wrappers to prevent fomantic from messing with it.
- Change rendered HTML to match GitHub.
- Add custom styling for the checkboxes.

* fix unittest

Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
 2020-12-13 09:05:50 +08:00
zeripath
ce66ca7f9f
Restore checkbox rendering and prevent poor sanitization of spans (#11277) 
* Add test

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Restore checkbox rendering and prevent poor sanitization of spans

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Also fix preview context

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Also fix preview context

Signed-off-by: Andrew Thornton <art27@cantab.net>
 2020-05-03 17:17:24 -03:00
John Olheiser
9a33adcdd3 Allow kbd tags (#9245) 
* Allow kbd tags

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Add test

Signed-off-by: jolheiser <john.olheiser@gmail.com>
 2019-12-03 14:02:41 -05:00
Lunny Xiao
52e11b24bf Restructure markup & markdown to prepare for multiple markup language… (#2411) 
* restructure markup & markdown to prepare for multiple markup languages support

* adjust some functions between markdown and markup

* fix tests

* improve the comments
 2017-09-16 20:17:57 +03:00
Renamed from modules/markdown/sanitizer_test.go (Browse further)