Commit 8feec8d3 authored by lain's avatar lain
Browse files

Strip unsafe html on output in TwAPI.

parent a9bfbcae
......@@ -105,7 +105,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.ActivityRepresenter do
"id" => activity.id,
"user" => UserRepresenter.to_map(user, opts),
"attentions" => [],
"statusnet_html" => content,
"statusnet_html" => HtmlSanitizeEx.basic_html(content),
"text" => HtmlSanitizeEx.strip_tags(content),
"is_local" => true,
"is_post_verb" => true,
......
......@@ -67,7 +67,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.ActivityRepresenterTest do
}
}
content_html = "Some #content #mentioning <a href='#{mentioned_user.ap_id}'>@shp</shp>"
content_html = "<script>alert('YAY')</script>Some #content #mentioning <a href='#{mentioned_user.ap_id}'>@shp</a>"
content = HtmlSanitizeEx.strip_tags(content_html)
date = DateTime.from_naive!(~N[2016-05-24 13:26:08.003], "Etc/UTC") |> DateTime.to_iso8601
......@@ -108,7 +108,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.ActivityRepresenterTest do
"user" => UserRepresenter.to_map(user, %{for: follower}),
"is_local" => true,
"attentions" => [],
"statusnet_html" => content_html <> "<br>\n#nsfw",
"statusnet_html" => HtmlSanitizeEx.basic_html(content_html) <> "<br />\n#nsfw",
"text" => content <> "\n#nsfw",
"is_post_verb" => true,
"created_at" => "Tue May 24 13:26:08 +0000 2016",
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment