wiki.ohea.xyz/gollum
10
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

only allow <a> to have href and <img> to have src

Browse Source
This commit is contained in:
rick
2010-11-03 16:43:39 -07:00
parent 74b7248334
commit 740ed4362b
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/gollum.rb
+8 -5
View File
@@ -36,29 +36,32 @@ module Gollum
'thead', 'tr', 'tt', 'u', 'ul', 'var' 'thead', 'tr', 'tt', 'u', 'ul', 'var'
], ],
:attributes => { :attributes => {
'a' => ['href'],
'img' => ['src'],
:all => ['abbr', 'accept', 'accept-charset', :all => ['abbr', 'accept', 'accept-charset',
'accesskey', 'action', 'align', 'alt', 'axis', 'accesskey', 'action', 'align', 'alt', 'axis',
'border', 'cellpadding', 'cellspacing', 'char', 'border', 'cellpadding', 'cellspacing', 'char',
'charoff', 'charset', 'checked', 'cite', 'charoff', 'charset', 'checked', 'cite',
'class', 'clear', 'cols', 'colspan', 'color', 'clear', 'cols', 'colspan', 'color',
'compact', 'coords', 'datetime', 'dir', 'compact', 'coords', 'datetime', 'dir',
'disabled', 'enctype', 'for', 'frame', 'disabled', 'enctype', 'for', 'frame',
'headers', 'height', 'href', 'hreflang', 'headers', 'height', 'hreflang',
'hspace', 'id', 'ismap', 'label', 'lang', 'hspace', 'ismap', 'label', 'lang',
'longdesc', 'maxlength', 'media', 'method', 'longdesc', 'maxlength', 'media', 'method',
'multiple', 'name', 'nohref', 'noshade', 'multiple', 'name', 'nohref', 'noshade',
'nowrap', 'prompt', 'readonly', 'rel', 'rev', 'nowrap', 'prompt', 'readonly', 'rel', 'rev',
'rows', 'rowspan', 'rules', 'scope', 'rows', 'rowspan', 'rules', 'scope',
'selected', 'shape', 'size', 'span', 'src', 'selected', 'shape', 'size', 'span',
'start', 'summary', 'tabindex', 'target', 'start', 'summary', 'tabindex', 'target',
'title', 'type', 'usemap', 'valign', 'value', 'title', 'type', 'usemap', 'valign', 'value',
'vspace', 'width'] 'vspace', 'width']
}, },
:protocols => { :protocols => {
'a' => {'href' => ['http', 'https', 'mailto', :relative]}, 'a' => {'href' => ['http', 'https', 'mailto', :relative]},
'img' => {'href' => ['http', 'https', :relative]} 'img' => {'src' => ['http', 'https', :relative]}
} }
} }
HISTORY_SANITIZATION_OPTIONS = SANITIZATION_OPTIONS.merge( HISTORY_SANITIZATION_OPTIONS = SANITIZATION_OPTIONS.merge(
:add_attributes => { :add_attributes => {
'a' => {'rel' => 'nofollow'} 'a' => {'rel' => 'nofollow'}