71 lines
2.5 KiB
Ruby
71 lines
2.5 KiB
Ruby
# Sanitize: http://github.com/rgrove/sanitize.git
|
|
class Sanitize
|
|
# This defines the configuration we use for HTML tags and attributes allowed in the archive.
|
|
module Config
|
|
ARCHIVE = freeze_config(
|
|
elements: %w[
|
|
a abbr acronym address b big blockquote br caption center cite code col
|
|
colgroup details figcaption figure dd del dfn div dl dt em h1 h2 h3 h4 h5 h6 hr
|
|
i img ins kbd li ol p pre q rp rt ruby s samp small span strike strong
|
|
sub summary sup table tbody td tfoot th thead tr tt u ul var
|
|
],
|
|
attributes: {
|
|
all: %w[align title dir],
|
|
"a" => %w[href name],
|
|
"blockquote" => %w[cite],
|
|
"col" => %w[span width],
|
|
"colgroup" => %w[span width],
|
|
"details" => %w[open],
|
|
"hr" => %w[align width],
|
|
"img" => %w[align alt border height src width],
|
|
"ol" => %w[start type],
|
|
"q" => %w[cite],
|
|
"table" => %w[border summary width],
|
|
"td" => %w[abbr axis colspan height rowspan width],
|
|
"th" => %w[abbr axis colspan height rowspan scope width],
|
|
"ul" => %w[type]
|
|
},
|
|
|
|
add_attributes: {
|
|
"a" => { "rel" => "nofollow" }
|
|
},
|
|
|
|
protocols: {
|
|
"a" => { "href" => ["ftp", "http", "https", "mailto", :relative] },
|
|
"blockquote" => { "cite" => ["http", "https", :relative] },
|
|
"img" => { "src" => ["http", "https"] },
|
|
"q" => { "cite" => ["http", "https", :relative] }
|
|
},
|
|
|
|
# TODO: This can be removed once we upgrade sanitizer gem, AO3-5801
|
|
# I would leave the tests we added in AO3-5974 though.
|
|
remove_contents: %w[iframe math noembed noframes noscript plaintext script style svg xmp]
|
|
)
|
|
|
|
CLASS_ATTRIBUTE = freeze_config(
|
|
# see in the Transformers section for what classes we strip
|
|
attributes: {
|
|
all: ARCHIVE[:attributes][:all] + ["class"]
|
|
}
|
|
)
|
|
|
|
CSS_ALLOWED = freeze_config(merge(ARCHIVE, CLASS_ATTRIBUTE))
|
|
|
|
# On details elements, force boolean attribute "open" to have
|
|
# value "open", if it exists
|
|
OPEN_ATTRIBUTE_TRANSFORMER = lambda do |env|
|
|
return unless env[:node_name] == "details"
|
|
|
|
env[:node]["open"] = "open" if env[:node].has_attribute?("open")
|
|
end
|
|
|
|
# On img elements, convert relative paths to absolute:
|
|
RELATIVE_IMAGE_PATH_TRANSFORMER = lambda do |env|
|
|
return unless env[:node_name] == "img" && env[:node]["src"]
|
|
|
|
env[:node]["src"] = URI.join(ArchiveConfig.APP_URL, env[:node]["src"])
|
|
rescue URI::InvalidURIError
|
|
# do nothing, the sanitizer will handle it
|
|
end
|
|
end
|
|
end
|