diff --git a/pagure/lib/__init__.py b/pagure/lib/__init__.py index fb2428a..fbe26e6 100644 --- a/pagure/lib/__init__.py +++ b/pagure/lib/__init__.py @@ -20,6 +20,7 @@ import shutil import tempfile import uuid +import bleach import sqlalchemy import sqlalchemy.schema from datetime import timedelta @@ -2261,3 +2262,18 @@ def text2markdown(text): return markdown.markdown('\n'.join(ntext)) return '' + +def clean_input(text): + """ For a given html text, escape everything we do not want to support + to avoid potential security breach. + """ + attrs = bleach.ALLOWED_ATTRIBUTES + attrs['img'] = filter_img_src + return bleach.clean( + text, + tags=bleach.ALLOWED_TAGS + [ + 'p', 'br', 'div', 'h1', 'h2', 'h3', 'table', 'td', 'tr', 'th', + 'col', 'tbody', 'pre', 'img', 'hr', + ], + attributes=attrs, + ) diff --git a/pagure/ui/filters.py b/pagure/ui/filters.py index 703dc46..53c9024 100644 --- a/pagure/ui/filters.py +++ b/pagure/ui/filters.py @@ -13,7 +13,6 @@ import textwrap import urlparse import arrow -import bleach import flask from pygments import highlight @@ -304,16 +303,7 @@ def no_js(content): """ Template filter replacing