Skip to content

Commit db85844

Browse files
zjjhotzjjhot
committed
Merge remote-tracking branch 'giteaofficial/main'
* giteaofficial/main: [skip ci] Updated translations via Crowdin Add Index to comment for migrations and mirroring (go-gitea#18806) Support ignore all santize for external renderer (go-gitea#18984)
2 parents 26c0a78 + 98f5408 commit db85844

File tree

18 files changed

+106
-23
lines changed

18 files changed

+106
-23
lines changed

‎custom/conf/app.example.ini‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2125,6 +2125,8 @@ PATH =
21252125
;RENDER_COMMAND = "asciidoc --out-file=- -"
21262126
;; Don't pass the file on STDIN, pass the filename as argument instead.
21272127
;IS_INPUT_FILE = false
2128+
; Don't filter html tags and attributes if true
2129+
;DISABLE_SANITIZER = false
21282130

21292131
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
21302132
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

‎docs/content/doc/advanced/config-cheat-sheet.en-us.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1003,13 +1003,13 @@ IS_INPUT_FILE = false
10031003
command. Multiple extensions needs a comma as splitter.
10041004
- RENDER\_COMMAND: External command to render all matching extensions.
10051005
- IS\_INPUT\_FILE: **false** Input is not a standard input but a file param followed `RENDER_COMMAND`.
1006+
- DISABLE_SANITIZER: **false** Don't filter html tags and attributes if true. Don't change this to true except you know what that means.
10061007

10071008
Two special environment variables are passed to the render command:
10081009
- `GITEA_PREFIX_SRC`, which contains the current URL prefix in the `src` path tree. To be used as prefix for links.
10091010
- `GITEA_PREFIX_RAW`, which contains the current URL prefix in the `raw` path tree. To be used as prefix for image paths.
10101011

1011-
1012-
Gitea supports customizing the sanitization policy for rendered HTML. The example below will support KaTeX output from pandoc.
1012+
If `DISABLE_SANITIZER` is false, Gitea supports customizing the sanitization policy for rendered HTML. The example below will support KaTeX output from pandoc.
10131013

10141014
```ini
10151015
[markup.sanitizer.TeX]

‎docs/content/doc/advanced/config-cheat-sheet.zh-cn.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -318,6 +318,33 @@ IS_INPUT_FILE = false
318318
- FILE_EXTENSIONS: 关联的文档的扩展名，多个扩展名用都好分隔。
319319
- RENDER_COMMAND: 工具的命令行命令及参数。
320320
- IS_INPUT_FILE: 输入方式是最后一个参数为文件路径还是从标准输入读取。
321+
- DISABLE_SANITIZER: **false** 如果为 true 则不过滤 HTML 标签和属性。除非你知道这意味着什么，否则不要设置为 true。
322+
323+
以下两个环境变量将会被传递给渲染命令：
324+
325+
- `GITEA_PREFIX_SRC`：包含当前的`src`路径的URL前缀，可以被用于链接的前缀。
326+
- `GITEA_PREFIX_RAW`：包含当前的`raw`路径的URL前缀，可以被用于图片的前缀。
327+
328+
如果 `DISABLE_SANITIZER` 为 false，则 Gitea 支持自定义渲染 HTML 的净化策略。以下例子将用 pandoc 支持 KaTeX 输出。
329+
330+
```ini
331+
[markup.sanitizer.TeX]
332+
; Pandoc renders TeX segments as <span>s with the "math" class, optionally
333+
; with "inline" or "display" classes depending on context.
334+
ELEMENT = span
335+
ALLOW_ATTR = class
336+
REGEXP = ^\s*((math(\s+|$)|inline(\s+|$)|display(\s+|$)))+
337+
ALLOW_DATA_URI_IMAGES = true
338+
```
339+
340+
- `ELEMENT`: 将要被应用到该策略的 HTML 元素，不能为空。
341+
- `ALLOW_ATTR`: 将要被应用到该策略的属性，不能为空。
342+
- `REGEXP`: 正则表达式，用来匹配属性的内容。如果为空，则跟属性内容无关。
343+
- `ALLOW_DATA_URI_IMAGES`: **false** 允许 data uri 图片 (`<img src="data:image/png;base64,..."/>`)。
344+
345+
多个净化规则可以被同时定义，只要section名称最后一位不重复即可。如： `[markup.sanitizer.TeX-2]`。
346+
为了针对一种渲染类型进行一个特殊的净化策略，必须使用形如 `[markup.sanitizer.asciidoc.rule-1]` 的方式来命名 seciton。
347+
如果此规则没有匹配到任何渲染类型，它将会被应用到所有的渲染类型。
321348

322349
## Time (`time`)
323350

‎integrations/dump_restore_test.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,9 @@ func (c *compareDump) assertEquals(repoBefore, repoAfter *repo_model.Repository)
178178
assert.GreaterOrEqual(c.t, len(issues), 1)
179179
for _, issue := range issues {
180180
filename := filepath.Join("comments", fmt.Sprintf("%d.yml", issue.Number))
181-
comments, ok := c.assertEqual(filename, []base.Comment{}, compareFields{}).([]*base.Comment)
181+
comments, ok := c.assertEqual(filename, []base.Comment{}, compareFields{
182+
"Index": {ignore: true},
183+
}).([]*base.Comment)
182184
assert.True(c.t, ok)
183185
for _, comment := range comments {
184186
assert.EqualValues(c.t, issue.Number, comment.IssueIndex)

‎modules/markup/csv/csv.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,11 @@ func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
4646
}
4747
}
4848

49+
// SanitizerDisabled disabled sanitize if return true
50+
func (Renderer) SanitizerDisabled() bool {
51+
return false
52+
}
53+
4954
func writeField(w io.Writer, element, class, field string) error {
5055
if _, err := io.WriteString(w, "<"); err != nil {
5156
return err

‎modules/markup/external/external.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@ func (p *Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
5454
return p.MarkupSanitizerRules
5555
}
5656

57+
// SanitizerDisabled disabled sanitize if return true
58+
func (p *Renderer) SanitizerDisabled() bool {
59+
return p.DisableSanitizer
60+
}
61+
5762
func envMark(envName string) string {
5863
if runtime.GOOS == "windows" {
5964
return "%" + envName + "%"

‎modules/markup/markdown/markdown.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,11 @@ func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
221221
return []setting.MarkupSanitizerRule{}
222222
}
223223

224+
// SanitizerDisabled disabled sanitize if return true
225+
func (Renderer) SanitizerDisabled() bool {
226+
return false
227+
}
228+
224229
// Render implements markup.Renderer
225230
func (Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
226231
return render(ctx, input, output)

‎modules/markup/orgmode/orgmode.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,11 @@ func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
4747
return []setting.MarkupSanitizerRule{}
4848
}
4949

50+
// SanitizerDisabled disabled sanitize if return true
51+
func (Renderer) SanitizerDisabled() bool {
52+
return false
53+
}
54+
5055
// Render renders orgmode rawbytes to HTML
5156
func Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
5257
htmlWriter := org.NewHTMLWriter()

‎modules/markup/renderer.go‎

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ type Renderer interface {
8181
Extensions() []string
8282
NeedPostProcess() bool
8383
SanitizerRules() []setting.MarkupSanitizerRule
84+
SanitizerDisabled() bool
8485
Render(ctx *RenderContext, input io.Reader, output io.Writer) error
8586
}
8687

@@ -127,6 +128,12 @@ func RenderString(ctx *RenderContext, content string) (string, error) {
127128
return buf.String(), nil
128129
}
129130

131+
type nopCloser struct {
132+
io.Writer
133+
}
134+
135+
func (nopCloser) Close() error { return nil }
136+
130137
func render(ctx *RenderContext, renderer Renderer, input io.Reader, output io.Writer) error {
131138
var wg sync.WaitGroup
132139
var err error
@@ -136,18 +143,25 @@ func render(ctx *RenderContext, renderer Renderer, input io.Reader, output io.Wr
136143
_ = pw.Close()
137144
}()
138145

139-
pr2, pw2 := io.Pipe()
140-
defer func() {
141-
_ = pr2.Close()
142-
_ = pw2.Close()
143-
}()
144-
145-
wg.Add(1)
146-
go func() {
147-
err = SanitizeReader(pr2, renderer.Name(), output)
148-
_ = pr2.Close()
149-
wg.Done()
150-
}()
146+
var pr2 io.ReadCloser
147+
var pw2 io.WriteCloser
148+
149+
if !renderer.SanitizerDisabled() {
150+
pr2, pw2 = io.Pipe()
151+
defer func() {
152+
_ = pr2.Close()
153+
_ = pw2.Close()
154+
}()
155+
156+
wg.Add(1)
157+
go func() {
158+
err = SanitizeReader(pr2, renderer.Name(), output)
159+
_ = pr2.Close()
160+
wg.Done()
161+
}()
162+
} else {
163+
pw2 = nopCloser{output}
164+
}
151165

152166
wg.Add(1)
153167
go func() {

‎modules/migration/comment.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ import "time"
99

1010
// Comment is a standard comment information
1111
type Comment struct {
12-
IssueIndex int64 `yaml:"issue_index"`
12+
IssueIndex int64 `yaml:"issue_index"`
13+
Index int64
1314
PosterID int64 `yaml:"poster_id"`
1415
PosterName string `yaml:"poster_name"`
1516
PosterEmail string `yaml:"poster_email"`

0 commit comments

Comments
 (0)