From 95cc08732df33d5c6e748fe3f0e5c88eca3d1ba0 Mon Sep 17 00:00:00 2001 From: Matthias Andreas Benkard Date: Sun, 18 Jul 2021 21:33:24 +0200 Subject: KB66 Sanitize HTML in posts. Change-Id: I4987c74e90befb226f1bf1f06129a665f32544bf --- .../java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/main/java/eu') diff --git a/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java b/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java index 68f7a18..cd75afe 100644 --- a/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java +++ b/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java @@ -11,6 +11,8 @@ import com.vladsch.flexmark.parser.Parser; import com.vladsch.flexmark.util.data.MutableDataSet; import java.util.Arrays; import javax.enterprise.context.ApplicationScoped; +import org.jsoup.Jsoup; +import org.jsoup.safety.Whitelist; @ApplicationScoped public class MarkdownConverter { @@ -41,6 +43,7 @@ public class MarkdownConverter { public String htmlify(String markdown) { var parsedDocument = parser.parse(markdown); - return renderer.render(parsedDocument); + var unsanitizedHtml = renderer.render(parsedDocument); + return Jsoup.clean(unsanitizedHtml, Whitelist.relaxed()); } } -- cgit v1.2.3