Adding SanitizeHelper

- SanitizeHelper to use config/application.rb tags and attribute allowed Signed-off-by: Macartur Sousa <macartur.sc@gmail.com>

Adding SanitizeHelper
- SanitizeHelper to use config/application.rb tags and attribute allowed Signed-off-by: Macartur Sousa <macartur.sc@gmail.com>
Macartur Sousa · Rodrigo Souto
1 parent 4820ccb2
Showing 6 changed files with 42 additions and 17 deletions Show diff stats
app/helpers/sanitize_helper.rb
app/models/article.rb
app/models/link_list_block.rb
app/models/scrap.rb
app/models/textile_article.rb
config/application.rb
@@ -0,0 +1,25 @@
+module SanitizeHelper
+
+  def sanitize_html(text, type= :full_sanitize)
+      sanitizer(type).sanitize(text, scrubber: permit_scrubber)
+  end
+
+  def sanitize_link(text)
+      sanitizer(:white_list).sanitize(text, scrubber:permit_scrubber)
+  end
+
+protected
+
+  def permit_scrubber
+      scrubber = Rails::Html::PermitScrubber.new
+      scrubber.tags = Rails.application.config.action_view.sanitized_allowed_tags
+      scrubber.attributes = Rails.application.config.action_view.sanitized_allowed_attributes
+      scrubber
+  end
+
+  def sanitizer type = :full_sanitize
+    return HTML::WhiteListSanitizer.new if type == :white_list
+    HTML::FullSanitizer.new
+  end
+
+end
 class Article < ActiveRecord::Base
+  include SanitizeHelper
+
   attr_accessible :name, :body, :abstract, :profile, :tag_list, :parent,
                   :allow_members_to_edit, :translation_of_id, :language,
                   :license_id, :parent_id, :display_posts_in_current_language,
@@ -54,6 +56,7 @@ class Article &lt; ActiveRecord::Base
   track_actions :create_article, :after_create, :keep_params => [:name, :url, :lead, :first_image], :if => Proc.new { |a| a.is_trackable? && !a.image? }
   # xss_terminate plugin can't sanitize array fields
+  # sanitize_tag_list is used with SanitizeHelper
   before_save :sanitize_tag_list
   before_create do |article|
@@ -870,11 +873,6 @@ class Article &lt; ActiveRecord::Base
     tag_name.gsub(/[<>]/, '')
   end
-  def sanitize_html(text)
-    sanitizer = HTML::FullSanitizer.new
-    sanitizer.sanitize(text)
-  end
-
   def parent_archived?
      if self.parent_id_changed? && self.parent && self.parent.archived?
        errors.add(:parent_folder, N_('is archived!!'))
 class LinkListBlock < Block
+  include SanitizeHelper
+
   attr_accessible :links
   ICONS = [
@@ -85,9 +87,4 @@ class LinkListBlock &lt; Block
     end
   end
-  def sanitize_link(text)
-    sanitizer = HTML::WhiteListSanitizer.new
-    sanitizer.sanitize(text)
-  end
-
 end
 class Scrap < ActiveRecord::Base
+  include SanitizeHelper
+
   attr_accessible :content, :sender_id, :receiver_id, :scrap_id
   SEARCHABLE_FIELDS = {
@@ -41,8 +43,7 @@ class Scrap &lt; ActiveRecord::Base
   end
   def strip_all_html_tags
-    sanitizer = HTML::WhiteListSanitizer.new
-    self.content = sanitizer.sanitize(self.content, :tags => [])
+    self.content = sanitize_html(self.content)
   end
   def action_tracker_target
 class TextileArticle < TextArticle
+  include SanitizeHelper
   def self.short_description
     _('Text article with Textile markup language')
@@ -31,10 +32,9 @@ class TextileArticle &lt; TextArticle
   protected
   def convert_to_html(textile)
-    @@sanitizer ||= HTML::WhiteListSanitizer.new
     converter = RedCloth.new(textile|| '')
     converter.hard_breaks = false
-    @@sanitizer.sanitize(converter.to_html)
+    sanitize_html(converter.to_html, :white_list)
   end
 end
@@ -15,13 +15,17 @@ module Noosfero
     require 'noosfero/plugin'
-    ALLOWED_TAGS = %w( object embed param table tr th td applet comment iframe audio video source
+    # The plugin xss_terminator(located in vendor/plugins/xss_terminator) and the helper
+    # SanitizeHelper(located in app/helpers/sanitize_helper.rb) use
+    # ALLOWED_TAGS and ALLOWED_ATTRIBUTES to make a sanitize with html.
+
+    ALLOWED_TAGS = %w(object embed param table tr th td applet comment iframe audio video source
     strong em b i p code pre tt samp kbd var sub sup dfn cite big small address hr br div span h1
-    h2 h3 h4 h5 h6 ul ol li dl dt dd abbr acronym a img blockquote del ins)
+    h2 h3 h4 h5 h6 ul ol li dl dt dd abbr acronym a img blockquote del ins a)
     ALLOWED_ATTRIBUTES = %w(name href cite class title src xml:lang height datetime alt abbr width
       vspace hspace heigth value type data style target codebase archive data-macro align border
-      classid code flashvars scrolling frameborder controls autoplay colspan)
+      classid code flashvars scrolling frameborder controls autoplay colspan id rowspan)
     config.action_view.sanitized_allowed_tags = ALLOWED_TAGS
     config.action_view.sanitized_allowed_attributes = ALLOWED_ATTRIBUTES
@@ -0,0 +1,25 @@		@@ -0,0 +1,25 @@
	1	+module SanitizeHelper
	2	+
	3	+ def sanitize_html(text, type= :full_sanitize)
	4	+ sanitizer(type).sanitize(text, scrubber: permit_scrubber)
	5	+ end
	6	+
	7	+ def sanitize_link(text)
	8	+ sanitizer(:white_list).sanitize(text, scrubber:permit_scrubber)
	9	+ end
	10	+
	11	+protected
	12	+
	13	+ def permit_scrubber
	14	+ scrubber = Rails::Html::PermitScrubber.new
	15	+ scrubber.tags = Rails.application.config.action_view.sanitized_allowed_tags
	16	+ scrubber.attributes = Rails.application.config.action_view.sanitized_allowed_attributes
	17	+ scrubber
	18	+ end
	19	+
	20	+ def sanitizer type = :full_sanitize
	21	+ return HTML::WhiteListSanitizer.new if type == :white_list
	22	+ HTML::FullSanitizer.new
	23	+ end
	24	+
	25	+end