KB66 Sanitize HTML in posts.

Change-Id: I4987c74e90befb226f1bf1f06129a665f32544bf

1 files changed, 4 insertions, 1 deletions

diff --git a/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java b/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
index 68f7a18..cd75afe 100644
--- a/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
+++ b/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
@@ -11,6 +11,8 @@ import com.vladsch.flexmark.parser.Parser;
 import com.vladsch.flexmark.util.data.MutableDataSet;
 import java.util.Arrays;
 import javax.enterprise.context.ApplicationScoped;
+import org.jsoup.Jsoup;
+import org.jsoup.safety.Whitelist;
 
 @ApplicationScoped
 public class MarkdownConverter {
@@ -41,6 +43,7 @@ public class MarkdownConverter {
 
   public String htmlify(String markdown) {
     var parsedDocument = parser.parse(markdown);
-    return renderer.render(parsedDocument);
+    var unsanitizedHtml = renderer.render(parsedDocument);
+    return Jsoup.clean(unsanitizedHtml, Whitelist.relaxed());
   }
 }