Skip to content

Commit 8c05c6f

Browse files
wxiaoguangwxiaoguang
committed
fix
1 parent ba9258c commit 8c05c6f

23 files changed

Lines changed: 124 additions & 94 deletions

File tree

‎models/issues/comment.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"code.gitea.io/gitea/modules/htmlutil"
2525
"code.gitea.io/gitea/modules/json"
2626
"code.gitea.io/gitea/modules/log"
27+
"code.gitea.io/gitea/modules/markup"
2728
"code.gitea.io/gitea/modules/optional"
2829
"code.gitea.io/gitea/modules/references"
2930
"code.gitea.io/gitea/modules/structs"
@@ -543,6 +544,12 @@ func (c *Comment) EventTag() string {
543544
return fmt.Sprintf("event-%d", c.ID)
544545
}
545546

547+
func (c *Comment) GetSanitizeContentHTML() template.HTML {
548+
// mainly for type=4 CommentTypeCommitRef
549+
// the content is a link like <a href="{RepoLink}/commit/{CommitID}">message title</a> (from CreateRefComment)
550+
return markup.Sanitize(c.Content)
551+
}
552+
546553
// LoadLabel if comment.Type is CommentTypeLabel, then load Label
547554
func (c *Comment) LoadLabel(ctx context.Context) error {
548555
var label Label

‎modules/templates/helper.go‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,12 @@ func newFuncMapWebPage() template.FuncMap {
3232

3333
// -----------------------------------------------------------------
3434
// html/template related functions
35-
"dict": dict, // it's lowercase because this name has been widely used. Our other functions should have uppercase names.
36-
"Iif": iif,
37-
"Eval": evalTokens,
38-
"HTMLFormat": htmlFormat,
39-
"QueryEscape": queryEscape,
40-
"QueryBuild": QueryBuild,
41-
"SanitizeHTML": SanitizeHTML,
35+
"dict": dict, // it's lowercase because this name has been widely used. Our other functions should have uppercase names.
36+
"Iif": iif,
37+
"Eval": evalTokens,
38+
"HTMLFormat": htmlFormat,
39+
"QueryEscape": queryEscape,
40+
"QueryBuild": QueryBuild,
4241

4342
"PathEscape": url.PathEscape,
4443
"PathEscapeSegments": util.PathEscapeSegments,
@@ -146,9 +145,8 @@ func newFuncMapWebPage() template.FuncMap {
146145
}
147146
}
148147

149-
// SanitizeHTML sanitizes the input by default sanitization rules.
150-
func SanitizeHTML(s string) template.HTML {
151-
return markup.Sanitize(s)
148+
func sanitizeHTML(msg string) template.HTML {
149+
return markup.Sanitize(msg)
152150
}
153151

154152
func htmlFormat(s any, args ...any) template.HTML {

‎modules/templates/helper_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ func TestSubjectBodySeparator(t *testing.T) {
5858
}
5959

6060
func TestSanitizeHTML(t *testing.T) {
61-
assert.Equal(t, template.HTML(`<a href="/" rel="nofollow">link</a> xss <div>inline</div>`), SanitizeHTML(`<a href="/">link</a> <a href="javascript:">xss</a> <div style="dangerous">inline</div>`))
61+
assert.Equal(t, template.HTML(`<a href="/" rel="nofollow">link</a> xss <div>inline</div>`), sanitizeHTML(`<a href="/">link</a> <a href="javascript:">xss</a> <div style="dangerous">inline</div>`))
6262
}
6363

6464
func TestTemplateIif(t *testing.T) {

‎modules/templates/mail.go‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,16 @@ func mailBodyFuncMap() template.FuncMap {
6565
"NIL": func() any { return nil },
6666

6767
// html/template related functions
68-
"dict": dict,
69-
"Iif": iif,
70-
"Eval": evalTokens,
71-
"HTMLFormat": htmlFormat,
72-
"QueryEscape": queryEscape,
73-
"QueryBuild": QueryBuild,
74-
"SanitizeHTML": SanitizeHTML,
68+
"dict": dict,
69+
"Iif": iif,
70+
"Eval": evalTokens,
71+
"HTMLFormat": htmlFormat,
72+
"QueryEscape": queryEscape,
73+
"QueryBuild": QueryBuild,
74+
75+
// deprecated, use "HTMLFormat" instead, but some user custom mail templates still use it
76+
// see: https://github.com/go-gitea/gitea/issues/36049
77+
"SanitizeHTML": sanitizeHTML,
7578

7679
"PathEscape": url.PathEscape,
7780
"PathEscapeSegments": util.PathEscapeSegments,

‎modules/templates/util_render.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,26 @@ func (ut *RenderUtils) RenderThemeItem(info *webtheme.ThemeMetaInfo, iconSize in
279279
return htmlutil.HTMLFormat(`<div class="theme-menu-item" data-tooltip-content="%s">%s %s %s</div>`, info.GetDescription(), icon, info.DisplayName, extraIcon)
280280
}
281281

282+
func (ut *RenderUtils) RenderFlashMessage(typ, msg string) template.HTML {
283+
msg = strings.TrimSpace(msg)
284+
if msg == "" {
285+
return ""
286+
}
287+
288+
var msgContent template.HTML
289+
if strings.Contains(msg, "</pre>") || strings.Contains(msg, "</details>") {
290+
// If the message contains <pre> or <details>, no need to do more alignment or line-break processing, just sanitize it directly.
291+
msgContent = sanitizeHTML(msg)
292+
} else if !strings.Contains(msg, "\n") {
293+
// If the message is a single line, center-align it by wrapping it
294+
msgContent = htmlutil.HTMLFormat(`<div class="tw-text-center">%s</div>`, sanitizeHTML(msg))
295+
} else {
296+
// For a multi-line message, preserve line breaks, and left-align it.
297+
msgContent = htmlutil.HTMLFormat(`%s`, sanitizeHTML(strings.ReplaceAll(msg, "\n", "<br>")))
298+
}
299+
return htmlutil.HTMLFormat(`<div class="ui %s message flash-message flash-%s">%s</div>`, typ, typ, msgContent)
300+
}
301+
282302
func (ut *RenderUtils) RenderUnicodeEscapeToggleButton(escapeStatus *charset.EscapeStatus) template.HTML {
283303
if escapeStatus == nil || !escapeStatus.Escaped {
284304
return ""

‎routers/utils/utils.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,11 @@ package utils
55

66
import (
77
"html"
8-
"strings"
8+
"html/template"
99
)
1010

11-
// SanitizeFlashErrorString will sanitize a flash error string
12-
func SanitizeFlashErrorString(x string) string {
13-
return strings.ReplaceAll(html.EscapeString(x), "\n", "<br>")
11+
// EscapeFlashErrorString will escape the flash error string
12+
// Maybe do more sanitization in the future, e.g.: hide sensitive information, etc.
13+
func EscapeFlashErrorString(x string) template.HTML {
14+
return template.HTML(html.EscapeString(x))
1415
}

‎routers/utils/utils_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ func TestSanitizeFlashErrorString(t *testing.T) {
3434

3535
for _, tt := range tests {
3636
t.Run(tt.name, func(t *testing.T) {
37-
got := SanitizeFlashErrorString(tt.arg)
37+
got := EscapeFlashErrorString(tt.arg)
3838
assert.Equal(t, tt.want, got)
3939
})
4040
}

‎routers/web/devtest/devtest.go‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,8 @@ func List(ctx *context.Context) {
4545

4646
func FetchActionTest(ctx *context.Context) {
4747
_ = ctx.Req.ParseForm()
48-
ctx.Flash.Info("fetch-action: " + ctx.Req.Method + " " + ctx.Req.RequestURI + "<br>" +
49-
"Form: " + ctx.Req.Form.Encode() + "<br>" +
48+
ctx.Flash.Info("fetch-action: " + ctx.Req.Method + " " + ctx.Req.RequestURI + "\n" +
49+
"Form: " + ctx.Req.Form.Encode() + "\n" +
5050
"PostForm: " + ctx.Req.PostForm.Encode(),
5151
)
5252
time.Sleep(2 * time.Second)
@@ -192,11 +192,31 @@ func prepareMockData(ctx *context.Context) {
192192
prepareMockDataBadgeActionsSvg(ctx)
193193
case "/devtest/relative-time":
194194
prepareMockDataRelativeTime(ctx)
195+
case "/devtest/toast-and-message":
196+
prepareMockDataToastAndMessage(ctx)
195197
case "/devtest/unicode-escape":
196198
prepareMockDataUnicodeEscape(ctx)
197199
}
198200
}
199201

202+
func prepareMockDataToastAndMessage(ctx *context.Context) {
203+
msgWithDetails, _ := ctx.RenderToHTML("base/alert_details", map[string]any{
204+
"Message": "message with details <script>escape xss</script>",
205+
"Summary": "summary with details",
206+
"Details": "details line 1\n details line 2\n details line 3",
207+
})
208+
msgWithSummary, _ := ctx.RenderToHTML("base/alert_details", map[string]any{
209+
"Message": "message with summary <script>escape xss</script>",
210+
"Summary": "summary only",
211+
})
212+
213+
ctx.Flash.ErrorMsg = string(msgWithDetails)
214+
ctx.Flash.WarningMsg = string(msgWithSummary)
215+
ctx.Flash.InfoMsg = "a long message with line break\nthe second line <script>removed xss</script>"
216+
ctx.Flash.SuccessMsg = "single line message <script>removed xss</script>"
217+
ctx.Data["Flash"] = ctx.Flash
218+
}
219+
200220
func prepareMockDataUnicodeEscape(ctx *context.Context) {
201221
content := "// demo code\n"
202222
content += "if accessLevel != \"user\u202E \u2066// Check if admin (invisible char)\u2069 \u2066\" { }\n"

‎routers/web/feed/convert.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
activities_model "code.gitea.io/gitea/models/activities"
1616
"code.gitea.io/gitea/models/renderhelper"
1717
repo_model "code.gitea.io/gitea/models/repo"
18+
"code.gitea.io/gitea/modules/markup"
1819
"code.gitea.io/gitea/modules/markup/markdown"
1920
"code.gitea.io/gitea/modules/setting"
2021
"code.gitea.io/gitea/modules/templates"
@@ -237,7 +238,7 @@ func feedActionsToFeedItems(ctx *context.Context, actions activities_model.Actio
237238
}
238239
}
239240
if len(content) == 0 {
240-
content = templates.SanitizeHTML(desc)
241+
content = markup.Sanitize(desc)
241242
}
242243

243244
items = append(items, &feeds.Item{

‎routers/web/repo/branch.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ func CreateBranch(ctx *context.Context) {
231231
flashError, err := ctx.RenderToHTML(tplAlertDetails, map[string]any{
232232
"Message": ctx.Tr("repo.editor.push_rejected"),
233233
"Summary": ctx.Tr("repo.editor.push_rejected_summary"),
234-
"Details": utils.SanitizeFlashErrorString(e.Message),
234+
"Details": utils.EscapeFlashErrorString(e.Message),
235235
})
236236
if err != nil {
237237
ctx.ServerError("UpdatePullRequest.HTMLString", err)

0 commit comments

Comments
 (0)