Fixes #2408 - Allow additional safe HTML tags in sanitized markdown

webcompat · Apr 19, 2018 · beff4ab · beff4ab
1 parent dabac53
commit beff4ab
Show file tree

Hide file tree

Showing 7 changed files with 267 additions and 232 deletions.
diff --git a/.eslintrc b/.eslintrc
@@ -25,6 +25,7 @@
     "md": true,
     "module": true,
     "moment": true,
+    "MarkdownSanitizerMixin": true,
     "Mousetrap": true,
     "PaginationMixin": true,
     "Prism": true,

diff --git a/grunt-tasks/concat.js b/grunt-tasks/concat.js
@@ -37,6 +37,7 @@ module.exports = function(grunt) {
     },
     issues: {
       src: [
+        "<%= jsPath %>/lib/mixins/extend-md-sanitizer.js",
         "<%= jsPath %>/lib/models/label-list.js",
         "<%= jsPath %>/lib/editor.js",
         "<%= jsPath %>/lib/labels.js",
@@ -54,6 +55,7 @@ module.exports = function(grunt) {
         "<%= jsPath %>/lib/models/label-list.js",
         "<%= jsPath %>/lib/models/issue.js",
         "<%= jsPath %>/lib/mixins/pagination.js",
+        "<%= jsPath %>/lib/mixins/extend-md-sanitizer.js",
         "<%= jsPath %>/lib/issue-list.js"
       ],
       dest: "<%= jsDistPath %>/issue-list.js"

diff --git a/webcompat/static/js/lib/comments.js b/webcompat/static/js/lib/comments.js
@@ -21,14 +21,20 @@ issues.CommentsCollection = Backbone.Collection.extend({
   }
 });
 
-issues.CommentView = Backbone.View.extend({
-  className: "issue-comment js-Issue-comment grid-cell x2",
-  id: function() {
-    return this.model.get("commentLinkId");
-  },
-  template: wcTmpl["issue/issue-comment-list.jst"],
-  render: function() {
-    this.$el.html(this.template(this.model.toJSON()));
-    return this;
-  }
-});
+var commentMarkdownSanitizer = new MarkdownSanitizerMixin();
+
+issues.CommentView = Backbone.View.extend(
+  _.extend({}, commentMarkdownSanitizer, {
+    className: "issue-comment js-Issue-comment grid-cell x2",
+    id: function() {
+      return this.model.get("commentLinkId");
+    },
+    template: wcTmpl["issue/issue-comment-list.jst"],
+    render: function() {
+      var modelData = this.model.toJSON();
+      modelData.body = this.sanitizeMarkdown(modelData.body);
+      this.$el.html(this.template(modelData));
+      return this;
+    }
+  })
+);