From 95cc08732df33d5c6e748fe3f0e5c88eca3d1ba0 Mon Sep 17 00:00:00 2001
From: Matthias Andreas Benkard <code@mail.matthias.benkard.de>
Date: Sun, 18 Jul 2021 21:33:24 +0200
Subject: KB66 Sanitize HTML in posts.

Change-Id: I4987c74e90befb226f1bf1f06129a665f32544bf
---
 .../java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java     | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/main/java/eu')

diff --git a/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java b/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
index 68f7a18..cd75afe 100644
--- a/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
+++ b/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
@@ -11,6 +11,8 @@ import com.vladsch.flexmark.parser.Parser;
 import com.vladsch.flexmark.util.data.MutableDataSet;
 import java.util.Arrays;
 import javax.enterprise.context.ApplicationScoped;
+import org.jsoup.Jsoup;
+import org.jsoup.safety.Whitelist;
 
 @ApplicationScoped
 public class MarkdownConverter {
@@ -41,6 +43,7 @@ public class MarkdownConverter {
 
   public String htmlify(String markdown) {
     var parsedDocument = parser.parse(markdown);
-    return renderer.render(parsedDocument);
+    var unsanitizedHtml = renderer.render(parsedDocument);
+    return Jsoup.clean(unsanitizedHtml, Whitelist.relaxed());
   }
 }
-- 
cgit v1.2.3