go-pkgz / auth

Authenticator via oauth2, direct, email and telegram
https://go-pkgz.umputun.dev/auth/
MIT License
1.07k stars 84 forks source link

Remove bluemonday and fix double-escaping #184

Closed david-bezero closed 10 months ago

david-bezero commented 1 year ago

Fixes #183

Uses json.Marshal to build a correctly encoded user structure (replacing fmt.Sprintf), removing bluemonday from this part of the code entirely as it is not required.

Also updates the email template code to avoid double-encoding everything, and removes bluemonday as it is not necessary (any tags entered are encoded by the template library anyway, as seen in the test, so there is no risk of injection)

This preserves the whitespace / trimming tidy-up steps for the email data.

david-bezero commented 1 year ago

I'm not sure what to make of the linting error but it's not related to anything that changed in this PR:

G101: Potential hardcoded credentials: RSA private key (gosec)

(file: provider/apple_test.go)

paskal commented 1 year ago

@david-bezero, please rebase from the master to fix tests. Are there any changes expected in this PR based on previous comments, or it's in the final state for the review?

paskal commented 12 months ago

@david-bezero, gentle ping for an answer.

david-bezero commented 12 months ago

hey. Sorry I don't have time lately to update this PR, but to answer your question as far as I'm aware this is in a good state to review.

I can maybe rebase it some time next week.

umputun commented 11 months ago

Could you pls resolve the conflict? I'm going to merge it in and release a new version as soon as it done

david-bezero commented 10 months ago

Sorry for the delay; I've been away over the holidays. Rebased and force-pushed.

coveralls commented 10 months ago

Pull Request Test Coverage Report for Build 7463747212


Totals Coverage Status
Change from base Build 7265392742: -0.2%
Covered Lines: 2561
Relevant Lines: 3095

💛 - Coveralls