mirrors/gotosocial
1
0
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2025-10-29 23:32:24 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

[feature] Allow anchor href to work for footnotes, use ID prefix to avoid clashes (#4298)

Browse source 
Updates markdown parser + sanitizer to allow footnote anchors to work properly, with appropriate roles. Footnote anchor IDs and backrefs use the status ID as a prefix to avoid clashes, so that footnotes don't break when multiple footnoted statuses are rendered on the same page (eg., in a thread or on the account's home page).

closes https://codeberg.org/superseriousbusiness/gotosocial/issues/4296

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4298
Co-authored-by: tobi <tobi.smethurst@protonmail.com>
Co-committed-by: tobi <tobi.smethurst@protonmail.com>
This commit is contained in:
tobi 2025-06-30 12:56:50 +02:00 • committed by kim
commit 5fbaf5b7be
3 changed files with 38 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
internal/text/sanitize.go
View file

@ -124,17 +124,28 @@ var regular *bluemonday.Policy = func() *bluemonday.Policy {
*/
// Permit hyperlinks.
p.AllowAttrs("class", "href", "rel").OnElements("a")
p.AllowAttrs("class", "rel").OnElements("a")
// Permit footnote roles on anchor elements.
p.AllowAttrs("role").Matching(regexp.MustCompile("^doc-noteref$")).OnElements("a")
p.AllowAttrs("role").Matching(regexp.MustCompile("^doc-backlink$")).OnElements("a")
// URLs must be parseable by net/url.Parse().
p.RequireParseableURLs(true)
// Most common URL schemes only.
// Relative URLs are OK as we
// need fragments for footnotes.
p.AllowRelativeURLs(true)
// However *only* allow common schemes, and also
// relative URLs beginning with "#", ie., fragments.
// We don't want URL's like "../../peepee.html".
p.AllowURLSchemes("mailto", "http", "https")
p.AllowAttrs("href").Matching(regexp.MustCompile("^(?:#|mailto|https://|http://).+$")).OnElements("a")
// Force rel="noreferrer".
// See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel/noreferrer
p.RequireNoReferrerOnLinks(true)
p.RequireNoReferrerOnFullyQualifiedLinks(true)
// Add rel="nofollow" on all fully qualified (not relative) links.
// See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel#nofollow