From d571a2c2026e19278d6b41e773d9ab3e98373b93 Mon Sep 17 00:00:00 2001
From: Gergely Nagy <forgejo@gergo.csillger.hu>
Date: Sat, 23 Mar 2024 17:16:22 +0100
Subject: [PATCH] Remove some more dead code from the markup sanitizer
This removes some more dead code from the markup sanitizer:
- Allowing unlabelled labels is no longer neccessary as of
41e8b834afbd0c98a8ab4549a90a6bce0ec7096f.
- Allowing `style` attributes on `span` and `p` are no longer necessary,
`bluemonday` allows them by default now.
Selectively cherry picked from commit 66902d89e567ab1ae6dfb828636999c61ff0149e.
Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
---
modules/markup/sanitizer.go | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/modules/markup/sanitizer.go b/modules/markup/sanitizer.go
index ffc33c3b8e..b942406901 100644
--- a/modules/markup/sanitizer.go
+++ b/modules/markup/sanitizer.go
@@ -105,18 +105,12 @@ func createDefaultPolicy() *bluemonday.Policy {
// Allow icons
policy.AllowAttrs("class").Matching(regexp.MustCompile(`^icon(\s+[\p{L}\p{N}_-]+)+$`)).OnElements("i")
- // Allow unlabelled labels
- policy.AllowNoAttrs().OnElements("label")
-
// Allow classes for emojis
policy.AllowAttrs("class").Matching(regexp.MustCompile(`emoji`)).OnElements("img")
// Allow icons, emojis, chroma syntax and keyword markup on span
policy.AllowAttrs("class").Matching(regexp.MustCompile(`^((icon(\s+[\p{L}\p{N}_-]+)+)|(emoji)|(language-math display)|(language-math inline))$|^([a-z][a-z0-9]{0,2})$|^` + keywordClass + `$`)).OnElements("span")
- // Allow 'style' attribute on text elements.
- policy.AllowAttrs("style").OnElements("span", "p")
-
// Allow 'color' and 'background-color' properties for the style attribute on text elements.
policy.AllowStyles("color", "background-color").OnElements("span", "p")
@@ -144,7 +138,7 @@ func createDefaultPolicy() *bluemonday.Policy {
generalSafeElements := []string{
"h1", "h2", "h3", "h4", "h5", "h6", "h7", "h8", "br", "b", "i", "strong", "em", "a", "pre", "code", "img", "tt",
- "div", "ins", "del", "sup", "sub", "p", "ol", "ul", "table", "thead", "tbody", "tfoot", "blockquote",
+ "div", "ins", "del", "sup", "sub", "p", "ol", "ul", "table", "thead", "tbody", "tfoot", "blockquote", "label",
"dl", "dt", "dd", "kbd", "q", "samp", "var", "hr", "ruby", "rt", "rp", "li", "tr", "td", "th", "s", "strike", "summary",
"details", "caption", "figure", "figcaption",
"abbr", "bdo", "cite", "dfn", "mark", "small", "span", "time", "video", "wbr",