<%= topic_title_tag(@topic) %>.
diff --git a/app/views/topics/feed.builder b/app/views/topics/feed.builder
index cac080173d..9c9e8dbf73 100644
--- a/app/views/topics/feed.builder
+++ b/app/views/topics/feed.builder
@@ -8,7 +8,7 @@ xml.rss(version: "2.0"){
for topic in @topics
xml.item do
xml.title topic.title
- xml.description raw(topic.body_html)
+ xml.description markdown(topic.body)
xml.author topic.user.login
xml.pubDate(topic.created_at.strftime("%a, %d %b %Y %H:%M:%S %z"))
xml.link topic_url topic
diff --git a/app/views/topics/node_feed.builder b/app/views/topics/node_feed.builder
index 4500aa45b8..2a5f54c340 100644
--- a/app/views/topics/node_feed.builder
+++ b/app/views/topics/node_feed.builder
@@ -7,7 +7,7 @@ xml.rss version: "2.0" do
for topic in @topics
xml.item do
xml.title topic.title
- xml.description raw(topic.body_html)
+ xml.description markdown(topic.body)
xml.author topic.user.login
xml.pubDate topic.created_at.strftime("%a, %d %b %Y %H:%M:%S %z")
xml.link topic_url(topic)
diff --git a/app/views/topics/show.html.erb b/app/views/topics/show.html.erb
index 9d57eb83b9..282eaf5e59 100644
--- a/app/views/topics/show.html.erb
+++ b/app/views/topics/show.html.erb
@@ -36,7 +36,7 @@
<%= raw Setting.before_topic_html %>
- <%= raw @topic.body_html %>
+ <%= @topic.body_html %>
diff --git a/app/views/users/_replies.html.erb b/app/views/users/_replies.html.erb
index b593f3dc36..854957092a 100644
--- a/app/views/users/_replies.html.erb
+++ b/app/views/users/_replies.html.erb
@@ -8,7 +8,7 @@
at <%= timeago(reply.created_at) %>
- <%= raw reply.body_html %>
+ <%= reply.body_html %>
<% end %>
diff --git a/db/migrate/20161215014636_remove_body_html_field.rb b/db/migrate/20161215014636_remove_body_html_field.rb
new file mode 100644
index 0000000000..3fa9238f6f
--- /dev/null
+++ b/db/migrate/20161215014636_remove_body_html_field.rb
@@ -0,0 +1,8 @@
+class RemoveBodyHtmlField < ActiveRecord::Migration[5.0]
+ def change
+ remove_column :topics, :body_html
+ remove_column :replies, :body_html
+ remove_column :pages, :body_html
+ remove_column :comments, :body_html
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 2818f5097b..f68d54658d 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
#
# It's strongly recommended that you check this file into your version control system.
-ActiveRecord::Schema.define(version: 20160912124102) do
+ActiveRecord::Schema.define(version: 20161215014636) do
# These are extensions that must be enabled in order to support this database
enable_extension "plpgsql"
@@ -26,7 +26,6 @@
create_table "comments", force: :cascade do |t|
t.text "body", null: false
- t.text "body_html"
t.integer "user_id", null: false
t.string "commentable_type"
t.integer "commentable_id"
@@ -164,7 +163,6 @@
t.string "slug", null: false
t.string "title", null: false
t.text "body", null: false
- t.text "body_html"
t.boolean "locked", default: false
t.integer "version", default: 0, null: false
t.integer "editor_ids", default: [], null: false, array: true
@@ -189,7 +187,6 @@
t.integer "user_id", null: false
t.integer "topic_id", null: false
t.text "body", null: false
- t.text "body_html"
t.integer "state", default: 1, null: false
t.integer "liked_user_ids", default: [], array: true
t.integer "likes_count", default: 0
@@ -264,7 +261,6 @@
t.integer "node_id", null: false
t.string "title", null: false
t.text "body", null: false
- t.text "body_html"
t.integer "last_reply_id"
t.integer "last_reply_user_id"
t.string "last_reply_user_login"
@@ -348,5 +344,4 @@
t.index ["login"], name: "index_users_on_login", using: :btree
t.index ["unlock_token"], name: "index_users_on_unlock_token", unique: true, using: :btree
end
-
end
diff --git a/lib/homeland/sanitize.rb b/lib/homeland/sanitize.rb
new file mode 100644
index 0000000000..1c7453ec03
--- /dev/null
+++ b/lib/homeland/sanitize.rb
@@ -0,0 +1,54 @@
+module Homeland
+ module Sanitize
+ # https://github.com/rgrove/sanitize#example-transformer-to-whitelist-youtube-video-embeds
+ YOUTUBE_TRANSFORMER = lambda do |env|
+ node = env[:node]
+ node_name = env[:node_name]
+
+ # Don't continue if this node is already whitelisted or is not an element.
+ return if env[:is_whitelisted] || !node.element?
+
+ # Don't continue unless the node is an iframe.
+ return unless node_name == 'iframe'
+
+ # Verify that the video URL is actually a valid YouTube video URL.
+ return unless node['src'] =~ %r|\A(?:https?:)?//(?:www\.)?youtube(?:-nocookie)?\.com/|
+
+ # We're now certain that this is a YouTube embed, but we still need to run
+ # it through a special Sanitize step to ensure that no unwanted elements or
+ # attributes that don't belong in a YouTube embed can sneak in.
+ ::Sanitize.node!(node, {
+ :elements => %w[iframe],
+
+ :attributes => {
+ 'iframe' => %w[allowfullscreen class frameborder height src width]
+ }
+ })
+
+ # Now that we're sure that this is a valid YouTube embed and that there are
+ # no unwanted elements or attributes hidden inside it, we can tell Sanitize
+ # to whitelist the current node.
+ {:node_whitelist => [node]}
+ end
+
+ DEFAULT = ::Sanitize::Config.freeze_config(
+ elements: %w[
+ p br img h1 h2 h3 h4 h5 h6 blockquote pre code b i del
+ strong em table tr td tbody th strike del u a ul ol li span hr
+ ],
+
+ attributes: ::Sanitize::Config.merge({},
+ # 这里要确保是 :all, 而不是 'all'
+ :all => %w[class id lang style tabindex title translate],
+ 'a' => %w[href rel data-floor target],
+ 'img' => %w[alt src width height]
+ ),
+
+ protocols: {
+ 'a' => { 'href' => ['http', 'https', 'mailto', :relative] }
+ },
+
+ transformers: [YOUTUBE_TRANSFORMER],
+ )
+ end
+end
\ No newline at end of file
diff --git a/spec/api/replies_spec.rb b/spec/api/replies_spec.rb
index 3be5c976fe..fa77116a2a 100644
--- a/spec/api/replies_spec.rb
+++ b/spec/api/replies_spec.rb
@@ -52,9 +52,7 @@
expect(response.status).to eq(200)
reply.reload
expect(json['reply']['body']).to eq 'bar dar'
- expect(json['reply']['body_html']).to eq reply.body_html
expect(reply.body).to eq 'bar dar'
- expect(reply.body_html).to eq '
bar dar
'
end
it 'should work by admin' do
diff --git a/spec/factories/pages.rb b/spec/factories/pages.rb
index 0f737de632..74363e4d1c 100644
--- a/spec/factories/pages.rb
+++ b/spec/factories/pages.rb
@@ -3,6 +3,5 @@
sequence(:slug) { |n| "slug#{n}" }
sequence(:title) { |n| "title#{n}" }
sequence(:body) { |n| "body#{n}" }
- sequence(:body_html) { |n| "body_html#{n}" }
end
end
diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb
index 16d4d7a280..3408349b17 100644
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -1,10 +1,54 @@
require 'rails_helper'
describe ApplicationHelper, type: :helper do
- it 'sanitize_markdown' do
- expect(helper.sanitize_markdown('link')).to eq('link')
+ describe '.sanitize_markdown' do
+ describe '' do
+ it 'should block javascript' do
+ expect(helper.sanitize_markdown('link')).to eq('link')
+ end
+ end
+
+ describe '')).to eq('alert();')
+ end
+ end
+
+ describe '')).to eq('.body{}')
+ end
+ end
+
+ describe '')).to eq('')
+ end
+
+ it 'should allow youtube iframe' do
+ html = '
+
+ '
+ expect(helper.sanitize_markdown(html)).to eq(html)
+ end
+ end
+
+ describe 'img' do
+ it 'should work' do
+ html = ''
+ expect(helper.sanitize_markdown(html)).to eq(html)
+ end
+ end
+
+ describe 'a' do
+ it 'should work' do
+ html = '111'
+ expect(helper.sanitize_markdown(html)).to eq(html)
+ end
+ end
end
+
describe 'markdown' do
context 'bad html' do
it 'filter script' do
diff --git a/spec/models/reply_spec.rb b/spec/models/reply_spec.rb
index b055c4ab38..cecf713a23 100644
--- a/spec/models/reply_spec.rb
+++ b/spec/models/reply_spec.rb
@@ -110,38 +110,6 @@
end
end
- describe 'format body' do
- it 'should covert body with Markdown on create' do
- r = create(:reply, body: '*foo*')
- expect(r.body_html).to eq('
foo
')
- end
-
- it 'should covert body on save' do
- r = create(:reply, body: '*foo*')
- old_html = r.body_html
- r.body = '*bar*'
- r.save
- expect(r.body_html).not_to eq(old_html)
- end
-
- it 'should not store body_html when it not changed' do
- r = create(:reply, body: '*foo*')
- r.body = '*fooaa*'
- allow(r).to receive(:body_changed?).and_return(false)
- old_html = r.body_html
- r.save
- expect(r.body_html).to eq(old_html)
- end
-
- context '#link_mention_user' do
- it 'should add link to mention users' do
- body = '@foo'
- reply = create(:reply, body: body)
- expect(reply.body_html).to eq('
')
- end
- end
- end
-
describe 'ban words for Reply body' do
let(:topic) { create(:topic) }
it 'should work' do
diff --git a/spec/models/topic_spec.rb b/spec/models/topic_spec.rb
index 098fc46a5d..a518991d06 100644
--- a/spec/models/topic_spec.rb
+++ b/spec/models/topic_spec.rb
@@ -72,11 +72,6 @@
expect(topic.last_active_mark).to eq(old_last_active_mark)
end
- it 'should covert body with Markdown on create' do
- t = create(:topic, body: '*foo*')
- expect(t.body_html).to eq('
foo
')
- end
-
it 'should get page and floor by reply' do
replies = []
5.times do
@@ -86,23 +81,6 @@
expect(topic.floor_of_reply(replies[3])).to eq(4)
end
- it 'should covert body on save' do
- t = create(:topic, body: '*foo*')
- old_html = t.body_html
- t.body = '*bar*'
- t.save
- expect(t.body_html).not_to eq(old_html)
- end
-
- it 'should not store body_html when it not changed' do
- t = create(:topic, body: '*foo*')
- t.body = '*fooaa*'
- allow(t).to receive(:body_changed?).and_return(false)
- old_html = t.body_html
- t.save
- expect(t.body_html).to eq(old_html)
- end
-
it 'should log deleted user name when use destroy_by' do
t = create(:topic)
t.destroy_by(user)
'
+ expect(helper.sanitize_markdown(html)).to eq(html)
+ end
+ end
+
+ describe 'a' do
+ it 'should work' do
+ html = '111'
+ expect(helper.sanitize_markdown(html)).to eq(html)
+ end
+ end
end
+
describe 'markdown' do
context 'bad html' do
it 'filter script' do
diff --git a/spec/models/reply_spec.rb b/spec/models/reply_spec.rb
index b055c4ab38..cecf713a23 100644
--- a/spec/models/reply_spec.rb
+++ b/spec/models/reply_spec.rb
@@ -110,38 +110,6 @@
end
end
- describe 'format body' do
- it 'should covert body with Markdown on create' do
- r = create(:reply, body: '*foo*')
- expect(r.body_html).to eq('