Use strong_memoize to customize the SanitizationFilter whitelist
I never liked the hacky `customized?` method anyway, so this is cleaner.
This commit is contained in:
parent
89bffe083d
commit
d699362a09
1 changed files with 5 additions and 12 deletions
|
@ -4,27 +4,20 @@ module Banzai
|
|||
#
|
||||
# Extends HTML::Pipeline::SanitizationFilter with a custom whitelist.
|
||||
class SanitizationFilter < HTML::Pipeline::SanitizationFilter
|
||||
include Gitlab::Utils::StrongMemoize
|
||||
|
||||
UNSAFE_PROTOCOLS = %w(data javascript vbscript).freeze
|
||||
TABLE_ALIGNMENT_PATTERN = /text-align: (?<alignment>center|left|right)/
|
||||
|
||||
def whitelist
|
||||
whitelist = super.dup
|
||||
|
||||
customize_whitelist(whitelist)
|
||||
|
||||
whitelist
|
||||
strong_memoize(:whitelist) do
|
||||
customize_whitelist(super.dup)
|
||||
end
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def customized?(transformers)
|
||||
transformers.last.source_location[0] == __FILE__
|
||||
end
|
||||
|
||||
def customize_whitelist(whitelist)
|
||||
# Only push these customizations once
|
||||
return if customized?(whitelist[:transformers])
|
||||
|
||||
# Allow table alignment; we whitelist specific text-align values in a
|
||||
# transformer below
|
||||
whitelist[:attributes]['th'] = %w(style)
|
||||
|
|
Loading…
Reference in a new issue