Golang bluemonday.UGCPolicy函數代碼示例

func (p Property) DescriptionInMarkdown() (template.HTML, error) {
	unsafeMarkdown := blackfriday.MarkdownCommon([]byte(p.Description))
	safeMarkdown := bluemonday.UGCPolicy().SanitizeBytes(unsafeMarkdown)

	// todo sanitized markdown
	return template.HTML(safeMarkdown), nil
}

func generateArticleContent(r *app.Request) (string, string, models.Category, []byte) {
	articleJson := articleJsonBody{}

	r.DecodeJsonPayload(&articleJson)

	// params
	markdown := articleJson.Markdown
	title := articleJson.Title
	category_name := articleJson.Category
	unsafe := articleJson.Content

	// find category
	category := models.Category{}
	if category_name != "" {
		category.FindByName(category_name)
		if category.ID == 0 {
			category.Name = category_name
			category.Create()
		}
	}

	// HTML sanitizer
	html := bluemonday.UGCPolicy().SanitizeBytes([]byte(unsafe))

	return title, markdown, category, html
}

func (markdown Markdown) Extract(creativeWork *schema.CreativeWork, path string) error {
	markdownContent, err := ioutil.ReadFile(path)
	if nil != err {
		return err
	}

	unsafe := blackfriday.MarkdownCommon(markdownContent)
	p := bluemonday.UGCPolicy()
	p.RequireNoFollowOnLinks(false)
	p.AllowAttrs("class").Matching(regexp.MustCompile("^language-[a-zA-Z0-9]+$")).OnElements("code")
	html := p.SanitizeBytes(unsafe)

	doc, err := goquery.NewDocumentFromReader(bytes.NewReader(html))
	if nil != err {
		return err
	}

	doc.Find("a[href]").Each(func(i int, s *goquery.Selection) {
		link, _ := s.Attr("href")
		url, _ := url.Parse(link)

		if !url.IsAbs() {
			s.SetAttr("href", strings.Replace(link, ".md", ".jsonld", 1))
		}
	})

	creativeWork.Name = doc.Find("h1").Text()
	creativeWork.Text, err = doc.Find("body").Html()
	if nil != err {
		return err
	}

	return nil
}

func main() {
	// Define a policy, we are using the UGC policy as a base.
	p := bluemonday.UGCPolicy()

	// Add "rel=nofollow" to links
	p.RequireNoFollowOnLinks(true)
	p.RequireNoFollowOnFullyQualifiedLinks(true)

	// Open external links in a new window/tab
	p.AddTargetBlankToFullyQualifiedLinks(true)

	// Read input from stdin so that this is a nice unix utility and can receive
	// piped input
	dirty, err := ioutil.ReadAll(os.Stdin)
	if err != nil {
		log.Fatal(err)
	}

	// Apply the policy and write to stdout
	fmt.Fprint(
		os.Stdout,
		p.Sanitize(
			string(dirty),
		),
	)
}

func readPageAsHtml(docName, PageFilePath string) ([]byte, error) {
	data, err := ioutil.ReadFile(PageFilePath)
	if err != nil {
		return nil, err
	}

	unsafe := blackfriday.MarkdownCommon(data)
	// TODO: It could be possible sanitize content before and after
	// rendering the wiki-text tags. The post wiki-text sanitising would
	// be slightly looser and allow html class attributes.
	unsafe = kaufmann.RenderWikiText(docName, unsafe)

	p := bluemonday.UGCPolicy()
	p.AllowAttrs("class").Matching(bluemonday.SpaceSeparatedTokens).Globally()
	// NOTE: At the moment we are allowing anything to be placed in a data attribute.
	// We could add a regex to limit the value to valid and safe(!) characters.
	// But we will have to write a regex. I can't see any thing suitable in
	// the bluemonday code.
	// Related: http://stackoverflow.com/q/25897910/395461
	p.AllowAttrs("data-pageid").Globally()
	p.AllowAttrs("data-filename").Globally()
	html := p.SanitizeBytes(unsafe)

	return html, nil
}

func SanitizeHtml(input []byte) []byte {
	// return blackfriday.MarkdownCommon(input)
	policy := bluemonday.UGCPolicy()
	policy.AllowAttrs("width", "height", "src", "allowfullscreen", "frameborder").
		OnElements("iframe")
	return policy.SanitizeBytes(input)
}

// Markdown renders GitHub Flavored Markdown text.
func Markdown(text []byte) []byte {
	htmlFlags := 0
	renderer := &renderer{Html: blackfriday.HtmlRenderer(htmlFlags, "", "").(*blackfriday.Html)}

	// Parser extensions for GitHub Flavored Markdown.
	extensions := 0
	extensions |= blackfriday.EXTENSION_NO_INTRA_EMPHASIS
	extensions |= blackfriday.EXTENSION_TABLES
	extensions |= blackfriday.EXTENSION_FENCED_CODE
	extensions |= blackfriday.EXTENSION_AUTOLINK
	extensions |= blackfriday.EXTENSION_STRIKETHROUGH
	extensions |= blackfriday.EXTENSION_SPACE_HEADERS
	//extensions |= blackfriday.EXTENSION_HARD_LINE_BREAK

	unsanitized := blackfriday.Markdown(text, renderer, extensions)

	// GitHub Flavored Markdown-like sanitization policy.
	p := bluemonday.UGCPolicy()
	p.AllowAttrs("class").Matching(bluemonday.SpaceSeparatedTokens).OnElements("div", "span")
	p.AllowAttrs("class", "name").Matching(bluemonday.SpaceSeparatedTokens).OnElements("a")
	p.AllowAttrs("rel").Matching(regexp.MustCompile(`^nofollow$`)).OnElements("a")
	p.AllowAttrs("aria-hidden").Matching(regexp.MustCompile(`^true$`)).OnElements("a")
	p.AllowDataURIImages()

	return p.SanitizeBytes(unsanitized)
}

// MainHandler shows the main page.
func MainHandler(ctx context.Context, rw http.ResponseWriter, r *http.Request) {
	dataRenderer := data.FromContext(ctx)

	stat, err := os.Stat("news.md")
	var time time.Time
	if err == nil {
		time = stat.ModTime()
	}

	bte, err := ioutil.ReadFile("news.md")
	markdown := []byte("_Couldn't retrieve the latest news._")
	if err == nil {
		markdown = bte
	}

	output := blackfriday.MarkdownCommon(markdown)

	dataRenderer.Data = map[string]interface{}{
		"Title": "Main",
		"News":  template.HTML(bluemonday.UGCPolicy().SanitizeBytes(output)),
		"Time":  time,
		"Nav":   0,
	}
	dataRenderer.Template = "index"
}

func articleHandler(w http.ResponseWriter, req *http.Request) {
	uri := req.RequestURI
	name := uri[len("/article/"):]
	var selected Article

	for _, article := range gArticles {
		if name == article.name || name+".md" == article.name {
			selected = article
		}
	}

	if selected.path == "" {
		w.WriteHeader(404)
		fmt.Fprintf(w, "Not found")
		return
	}

	data, err := ioutil.ReadFile(selected.path)
	if err != nil {
		w.WriteHeader(500)
		fmt.Fprint(w, err)
		return
	}

	unsafe := blackfriday.MarkdownCommon(data)
	html := bluemonday.UGCPolicy().SanitizeBytes(unsafe)

	w.Header().Add("Content-Type", "text/html")
	w.WriteHeader(200)
	w.Write(html)
}

func Convert(input string) string {
	inputBytes := []byte(input)
	unsafeBytes := blackfriday.MarkdownCommon(inputBytes)
	htmlBytes := bluemonday.UGCPolicy().SanitizeBytes(unsafeBytes)

	return string(htmlBytes)
}

func main() {
	esInput := html.EscapeString(input)
	unsafe := blackfriday.MarkdownCommon([]byte(esInput))
	html := bluemonday.UGCPolicy().SanitizeBytes(unsafe)

	fmt.Println(string(html))
}

func renderMarkdown(c *gin.Context, currentText string, title string, versions []versionsInfo) {
	fmt.Println(currentText)
	unsafe := blackfriday.MarkdownCommon([]byte(currentText))
	fmt.Println(string(unsafe))
	pClean := bluemonday.UGCPolicy()
	pClean.AllowElements("img")
	pClean.AllowAttrs("alt").OnElements("img")
	pClean.AllowAttrs("src").OnElements("img")
	pClean.AllowDataURIImages()
	html := pClean.SanitizeBytes(unsafe)
	html2 := string(html)
	r, _ := regexp.Compile("\\$\\$(.*?)\\$\\$")
	for _, s := range r.FindAllString(html2, -1) {
		html2 = strings.Replace(html2, s, "<span class='texp' data-expr='"+s[2:len(s)-2]+"'></span>", 1)
	}
	r, _ = regexp.Compile("\\$(.*?)\\$")
	for _, s := range r.FindAllString(html2, -1) {
		html2 = strings.Replace(html2, s, "<span class='texi' data-expr='"+s[1:len(s)-1]+"'></span>", 1)
	}

	html2 = strings.Replace(html2, "&amp;#36;", "&#36;", -1)
	c.HTML(http.StatusOK, "view.tmpl", gin.H{
		"Title":    title,
		"Body":     template.HTML([]byte(html2)),
		"Versions": versions,
	})
}

func (presenter EntryPresenter) FormattedExcerpt() template.HTML {
	unescaped := html.UnescapeString(presenter.Excerpt)
	p := bluemonday.UGCPolicy()
	sanitized := p.Sanitize(unescaped)
	unescaped = html.UnescapeString(sanitized)
	return template.HTML(unescaped)
}

func (this *TopicController) View() {
	this.Data["IsLogin"] = checkAccount(this.Ctx)
	this.Data["IsTopic"] = true
	this.TplNames = "topic_view.html"

	topic, err := models.GetTopic(this.Ctx.Input.Param("0"))
	if err != nil {
		beego.Error(err)
		this.Redirect("/", 302)
		return
	}

	tid := this.Ctx.Input.Param("0")
	this.Data["Tid"] = tid
	this.Data["Tag"] = strings.Split(topic.Tag, ",")
	topic.Content = string(blackfriday.MarkdownCommon([]byte(topic.Content)))
	this.Data["Topic"] = topic

	replies, err := models.GetAllReplies(tid)
	if err != nil {
		beego.Error(err)
		return
	}

	for _, reply := range replies {
		unsafe := blackfriday.MarkdownCommon([]byte(reply.Content))
		reply.Content = string(bluemonday.UGCPolicy().SanitizeBytes(unsafe))
	}

	this.Data["Replies"] = replies
	this.locale()
}

func renderMarkdown(c *gin.Context, currentText string, title string, versions []versionsInfo, AdminKey string, totalTime time.Duration, encrypted bool, noprompt bool, locked bool, recentlyEdited []string) {
	originalText := currentText
	CodeType := getCodeType(title)
	if CodeType == "markdown" {
		CodeType = ""
	}
	r, _ := regexp.Compile("\\[\\[(.*?)\\]\\]")
	for _, s := range r.FindAllString(currentText, -1) {
		currentText = strings.Replace(currentText, s, "["+s[2:len(s)-2]+"](/"+s[2:len(s)-2]+"/view)", 1)
	}
	unsafe := blackfriday.MarkdownCommon([]byte(currentText))
	pClean := bluemonday.UGCPolicy()
	pClean.AllowElements("img")
	pClean.AllowAttrs("alt").OnElements("img")
	pClean.AllowAttrs("src").OnElements("img")
	pClean.AllowAttrs("class").OnElements("a")
	pClean.AllowAttrs("href").OnElements("a")
	pClean.AllowAttrs("id").OnElements("a")
	pClean.AllowDataURIImages()
	html := pClean.SanitizeBytes(unsafe)
	html2 := string(html)
	r, _ = regexp.Compile("\\$\\$(.*?)\\$\\$")
	for _, s := range r.FindAllString(html2, -1) {
		html2 = strings.Replace(html2, s, "<span class='texp' data-expr='"+s[2:len(s)-2]+"'></span>", 1)
	}
	r, _ = regexp.Compile("\\$(.*?)\\$")
	for _, s := range r.FindAllString(html2, -1) {
		html2 = strings.Replace(html2, s, "<span class='texi' data-expr='"+s[1:len(s)-1]+"'></span>", 1)
	}

	html2 = strings.Replace(html2, "&amp;#36;", "&#36;", -1)
	html2 = strings.Replace(html2, "&amp;#91;", "&#91;", -1)
	html2 = strings.Replace(html2, "&amp;#93;", "&#93;", -1)
	html2 = strings.Replace(html2, "&amp35;", "&#35;", -1)
	totalTimeString := totalTime.String()
	if totalTime.Seconds() < 1 {
		totalTimeString = "< 1 s"
	}
	if encrypted {
		CodeType = "asciiarmor"
	}
	c.HTML(http.StatusOK, "view.tmpl", gin.H{
		"Title":             title,
		"WikiName":          RuntimeArgs.WikiName,
		"Body":              template.HTML([]byte(html2)),
		"CurrentText":       originalText,
		"Versions":          versions,
		"TotalTime":         totalTimeString,
		"AdminKey":          AdminKey,
		"Encrypted":         encrypted,
		"Locked":            locked,
		"Prompt":            noprompt,
		"LockedOrEncrypted": locked || encrypted,
		"Coding":            len(CodeType) > 0,
		"CodeType":          CodeType,
		"RecentlyEdited":    recentlyEdited,
	})

}