microcosm-cc / bluemonday

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
https://github.com/microcosm-cc/bluemonday
BSD 3-Clause "New" or "Revised" License
3.2k stars 175 forks source link

AllowElements regex support #92

Closed theflyingcodr closed 4 years ago

theflyingcodr commented 5 years ago

Overview

This closes https://github.com/microcosm-cc/bluemonday/issues/91

It adds 3 new public methods for allowing elements to be allowed using a regex pattern, they are:

policy.AllowElementsMatching(regexp) policy.AllowAttrs("span").OnElementsMatching(regexp) policy.AllowStyles("color","mystyle").OnElementsMatching(regexp)

This means all elements that match the regular expression provided, will be affected by the policy being built. This allows a common prefix for example to be used for custom elements and have them all be included in the sanitized output, along with any custom attrs or styles as we can do now on explicitly allowed elements using AllowElements(...)

Rules

Some rules have been implemented, would be good to get feedback:

1) If an element has been explicitly added via AllowElements those rules override any regex rules, the regex rules are simply ignored 2) Don't add multiple regex patterns that overlap, as order of execution is not guaranteed and another patterns rules could end up being matched instead of your intended. For example, rules added like AllowElementsMatching(regexp.MustCompile('^my-element-')) and AllowElementsMatching(regexp.MustCompile('^my-element-other')) would not be recommended as both will get matched and we won't know reliably which rule to use.

shaydoc commented 5 years ago

This will be so useful

shaydoc commented 4 years ago

@buro any updates on merging this PR?

grafana-dee commented 4 years ago

apologies for the delay... personal life is hard, I'm mostly offline atm

theflyingcodr commented 4 years ago

Thanks @buro9 :thumbsup:

shaydoc commented 4 years ago

Thanks for merging @buro sorry to hear things are hard, hope your situation improves soon.