diff --git a/api/album.go b/api/album.go index 9e56097..c6a2743 100644 --- a/api/album.go +++ b/api/album.go @@ -5,7 +5,6 @@ import ( "time" "codeberg.org/rimgo/rimgo/utils" - "github.com/microcosm-cc/bluemonday" "github.com/tidwall/gjson" ) @@ -101,17 +100,13 @@ func parseAlbum(data gjson.Result) (Album, error) { url := value.Get("url").String() url = strings.ReplaceAll(url, "https://i.imgur.com", "") - description := value.Get("metadata.description").String() - description = strings.ReplaceAll(description, "\n", "
") - description = bluemonday.UGCPolicy().Sanitize(description) - media = append(media, Media{ Id: value.Get("id").String(), Name: value.Get("name").String(), MimeType: value.Get("mime_type").String(), Type: value.Get("type").String(), Title: value.Get("metadata.title").String(), - Description: description, + Description: value.Get("metadata.description").String(), Url: url, }) diff --git a/api/comments.go b/api/comments.go index 931e7e0..c14ee57 100644 --- a/api/comments.go +++ b/api/comments.go @@ -4,16 +4,12 @@ import ( "encoding/json" "errors" "fmt" - "regexp" - "strings" "sync" "time" "codeberg.org/rimgo/rimgo/utils" - "github.com/microcosm-cc/bluemonday" "github.com/patrickmn/go-cache" "github.com/tidwall/gjson" - "gitlab.com/golang-commonmark/linkify" ) type Comment struct { @@ -64,50 +60,11 @@ func (client *Client) FetchComments(galleryID string) ([]Comment, error) { return parsed.Data, nil } -var imgurRe = regexp.MustCompile(`https?://imgur\.com/(gallery|a)?/(.*)`) -var imgurRe2 = regexp.MustCompile(`https?://imgur\.com/(.*)`) -var imgRe = regexp.MustCompile(`https?://i\.imgur\.com/(.*)\.(png|gif|jpe?g|webp)`) -var vidRe = regexp.MustCompile(`https?://i\.imgur\.com/(.*)\.(mp4|webm)`) -var vidFormatRe = regexp.MustCompile(`\.(mp4|webm)`) -var iImgurRe = regexp.MustCompile(`https?://i\.imgur\.com`) - func parseComment(data json.RawMessage, out *Comment) { err := json.Unmarshal(data, &out) if err != nil { panic(err) } - - comment := &out.Comment - *comment = strings.ReplaceAll(*comment, "\n", "
") - - for _, match := range imgRe.FindAllString(*comment, -1) { - img := iImgurRe.ReplaceAllString(match, "") - img = `` - *comment = strings.Replace(*comment, match, img, 1) - } - for _, match := range vidRe.FindAllString(*comment, -1) { - vid := iImgurRe.ReplaceAllString(match, "") - vid = `` - *comment = strings.Replace(*comment, match, vid, 1) - } - for _, l := range linkify.Links(*comment) { - origLink := (*comment)[l.Start:l.End] - link := `` + origLink + `` - *comment = strings.Replace(*comment, origLink, link, 1) - } - *comment = imgurRe.ReplaceAllString(*comment, "/$1/$2") - *comment = imgurRe2.ReplaceAllString(*comment, "/$1") - - p := bluemonday.UGCPolicy() - p.AllowImages() - p.AllowElements("video", "source") - p.AllowAttrs("src", "tvpe").OnElements("source") - p.AllowAttrs("controls", "loop", "preload", "poster").OnElements("video") - p.AllowAttrs("class", "loading").OnElements("img", "video") - p.RequireNoReferrerOnLinks(true) - p.RequireNoFollowOnLinks(true) - p.RequireCrossOriginAnonymous(true) - *comment = p.Sanitize(*comment) } type commentArray []Comment diff --git a/render/helpers.go b/render/helpers.go index 7f7ba11..79bd55a 100644 --- a/render/helpers.go +++ b/render/helpers.go @@ -10,10 +10,12 @@ import ( func (r *renderer) registerHelpers() { funcmap := map[string]any{ - "noteq": noteq, - "ifNonZeroTime": ifNonZeroTime, - "relTime": relTime, - "rewriteUrl": rewriteUrl, + "noteq": noteq, + "ifNonZeroTime": ifNonZeroTime, + "relTime": relTime, + "rewriteUrl": rewriteUrl, + "sanitizeDescription": sanitizeDescription, + "sanitizeComment": sanitizeComment, } raymond.RegisterHelpers(funcmap) } diff --git a/render/sanitize.go b/render/sanitize.go new file mode 100644 index 0000000..ee5235f --- /dev/null +++ b/render/sanitize.go @@ -0,0 +1,53 @@ +package render + +import ( + "regexp" + "strings" + + "github.com/microcosm-cc/bluemonday" + "gitlab.com/golang-commonmark/linkify" +) + +var imgurRe = regexp.MustCompile(`https?://imgur\.com/(gallery|a)?/(.*)`) +var imgurRe2 = regexp.MustCompile(`https?://imgur\.com/(.*)`) +var imgRe = regexp.MustCompile(`https?://i\.imgur\.com/(.*)\.(png|gif|jpe?g|webp)`) +var vidRe = regexp.MustCompile(`https?://i\.imgur\.com/(.*)\.(mp4|webm)`) +var vidFormatRe = regexp.MustCompile(`\.(mp4|webm)`) +var iImgurRe = regexp.MustCompile(`https?://i\.imgur\.com`) + +func sanitizeDescription(src string) string { + src = strings.ReplaceAll(src, "\n", "
") + return bluemonday.UGCPolicy().Sanitize(src) +} +func sanitizeComment(src string) string { + src = strings.ReplaceAll(src, "\n", "
") + + for _, match := range imgRe.FindAllString(src, -1) { + img := iImgurRe.ReplaceAllString(match, "") + img = `` + src = strings.Replace(src, match, img, 1) + } + for _, match := range vidRe.FindAllString(src, -1) { + vid := iImgurRe.ReplaceAllString(match, "") + vid = `` + src = strings.Replace(src, match, vid, 1) + } + for _, l := range linkify.Links(src) { + origLink := (src)[l.Start:l.End] + link := `` + origLink + `` + src = strings.Replace(src, origLink, link, 1) + } + src = imgurRe.ReplaceAllString(src, "/$1/$2") + src = imgurRe2.ReplaceAllString(src, "/$1") + + p := bluemonday.UGCPolicy() + p.AllowImages() + p.AllowElements("video", "source") + p.AllowAttrs("src", "tvpe").OnElements("source") + p.AllowAttrs("controls", "loop", "preload", "poster").OnElements("video") + p.AllowAttrs("class", "loading").OnElements("img", "video") + p.RequireNoReferrerOnLinks(true) + p.RequireNoFollowOnLinks(true) + p.RequireCrossOriginAnonymous(true) + return p.Sanitize(src) +} diff --git a/views/partials/comment.hbs b/views/partials/comment.hbs index 9a84906..d839387 100644 --- a/views/partials/comment.hbs +++ b/views/partials/comment.hbs @@ -11,7 +11,7 @@ {{/equal}}
-

{{{this.Comment}}}

+

{{{sanitizeComment(this.Comment)}}}

{{relTime(this.CreatedAt)}} {{#ifNonZeroTime this.DeletedAt}} diff --git a/views/partials/contextComment.hbs b/views/partials/contextComment.hbs index 5608901..8021b48 100644 --- a/views/partials/contextComment.hbs +++ b/views/partials/contextComment.hbs @@ -3,7 +3,7 @@
-

{{{this.Comment}}}

+

{{{sanitizeComment(this.Comment)}}}

{{relTime(this.CreatedAt)}} diff --git a/views/post.hbs b/views/post.hbs index e14ac46..4ff4937 100644 --- a/views/post.hbs +++ b/views/post.hbs @@ -75,7 +75,7 @@ {{/equal}} {{#if this.Description}} -

{{{this.Description}}}

+

{{{sanitizeDescription(this.Description)}}}

{{/if}} {{/each}}