Drop HTMLSanitizeEx and fix title sanitizing

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

CHANGELOG.md

@@ -6,9 +6,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Changed
+
+- Completely replaced HTMLSanitizeEx with FastSanitize [!490](https://framagit.org/framasoft/mobilizon/-/merge_requests/490)
+
 ### Fixed
 
-- Fixed notification scheduler (!486)[https://framagit.org/framasoft/mobilizon/-/merge_requests/486]
+- Fixed notification scheduler [!486](https://framagit.org/framasoft/mobilizon/-/merge_requests/486)
+- Fixed event title escaping [!490](https://framagit.org/framasoft/mobilizon/-/merge_requests/490)
 
 ## [1.0.0-beta.3] - 2020-06-24
 

lib/federation/activity_pub/activity_pub.ex

@@ -45,6 +45,7 @@ defmodule Mobilizon.Federation.ActivityPub do
   alias Mobilizon.Federation.WebFinger
 
   alias Mobilizon.GraphQL.API.Utils, as: APIUtils
+  alias Mobilizon.Service.Formatter.HTML
   alias Mobilizon.Service.Notifications.Scheduler
   alias Mobilizon.Service.RichMedia.Parser
 
@@ -499,7 +500,7 @@ defmodule Mobilizon.Federation.ActivityPub do
              metadata:
                additional
                |> Map.get(:metadata, %{})
-               |> Map.update(:message, nil, &String.trim(HtmlSanitizeEx.strip_tags(&1)))
+               |> Map.update(:message, nil, &String.trim(HTML.strip_tags(&1)))
            }),
          join_data <- Convertible.model_to_as(participant),
          audience <-
@@ -1257,7 +1258,7 @@ defmodule Mobilizon.Federation.ActivityPub do
     # If title is not set: we are not updating it
     args =
       if Map.has_key?(args, :title) && !is_nil(args.title),
-        do: Map.update(args, :title, "", &String.trim(HtmlSanitizeEx.strip_tags(&1))),
+        do: Map.update(args, :title, "", &String.trim/1),
         else: args
 
     # If we've been given a description (we might not get one if updating)
@@ -1344,7 +1345,7 @@ defmodule Mobilizon.Federation.ActivityPub do
 
   defp prepare_args_for_group(args) do
     with preferred_username <-
-           args |> Map.get(:preferred_username) |> HtmlSanitizeEx.strip_tags() |> String.trim(),
+           args |> Map.get(:preferred_username) |> HTML.strip_tags() |> String.trim(),
          summary <- args |> Map.get(:summary, "") |> String.trim(),
          {summary, _mentions, _tags} <-
            summary |> String.trim() |> APIUtils.make_content_html([], "text/html") do
@@ -1357,7 +1358,7 @@ defmodule Mobilizon.Federation.ActivityPub do
            {:reporter, Actors.get_actor!(args.reporter_id)},
          {:reported, %Actor{} = reported_actor} <-
            {:reported, Actors.get_actor!(args.reported_id)},
-         content <- HtmlSanitizeEx.strip_tags(args.content),
+         content <- HTML.strip_tags(args.content),
          event <- Conversations.get_comment(Map.get(args, :event_id)),
          {:get_report_comments, comments} <-
            {:get_report_comments,

lib/graphql/api/groups.ex

@@ -8,6 +8,7 @@ defmodule Mobilizon.GraphQL.API.Groups do
 
   alias Mobilizon.Federation.ActivityPub
   alias Mobilizon.Federation.ActivityPub.Activity
+  alias Mobilizon.Service.Formatter.HTML
 
   @doc """
   Create a group
@@ -15,7 +16,7 @@ defmodule Mobilizon.GraphQL.API.Groups do
   @spec create_group(map) :: {:ok, Activity.t(), Actor.t()} | any
   def create_group(args) do
     with preferred_username <-
-           args |> Map.get(:preferred_username) |> HtmlSanitizeEx.strip_tags() |> String.trim(),
+           args |> Map.get(:preferred_username) |> HTML.strip_tags() |> String.trim(),
          {:existing_group, nil} <-
            {:existing_group, Actors.get_local_group_by_title(preferred_username)},
          {:ok, %Activity{} = activity, %Actor{} = group} <-

lib/service/export/icalendar.ex

@@ -7,6 +7,7 @@ defmodule Mobilizon.Service.Export.ICalendar do
   alias Mobilizon.Actors.Actor
   alias Mobilizon.Addresses.Address
   alias Mobilizon.Events.{Event, FeedToken}
+  alias Mobilizon.Service.Formatter.HTML
   alias Mobilizon.Storage.Page
   alias Mobilizon.Users.User
 
@@ -31,7 +32,7 @@ defmodule Mobilizon.Service.Export.ICalendar do
       dtstart: event.begins_on,
       dtstamp: event.publish_at || DateTime.utc_now(),
       dtend: event.ends_on,
-      description: HtmlSanitizeEx.strip_tags(event.description),
+      description: HTML.strip_tags(event.description),
       uid: event.uuid,
       url: event.url,
       geo: Address.coords(event.physical_address),

lib/service/formatter/html.ex

@@ -14,5 +14,15 @@ defmodule Mobilizon.Service.Formatter.HTML do
 
   def filter_tags(html), do: Sanitizer.scrub(html, DefaultScrubbler)
 
+  def strip_tags(html) do
+    case FastSanitize.strip_tags(html) do
+      {:ok, html} ->
+        html
+
+      _ ->
+        raise "Failed to filter tags"
+    end
+  end
+
   def filter_tags_for_oembed(html), do: Sanitizer.scrub(html, OEmbed)
 end

lib/service/metadata/event.ex

@@ -2,6 +2,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Events.Event do
   alias Phoenix.HTML
   alias Phoenix.HTML.Tag
   alias Mobilizon.Events.Event
+  alias Mobilizon.Service.Formatter.HTML, as: HTMLFormatter
   alias Mobilizon.Web.JsonLD.ObjectView
   alias Mobilizon.Web.MediaProxy
   import Mobilizon.Web.Gettext
@@ -49,15 +50,15 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Events.Event do
 
   defp process_description(description, _locale) do
     description
-    |> HtmlSanitizeEx.strip_tags()
+    |> HTMLFormatter.strip_tags()
     |> String.slice(0..200)
     |> (&"#{&1}…").()
   end
 
   # Insert JSON-LD schema by hand because Tag.content_tag wants to escape it
-  defp json(%Event{} = event) do
+  defp json(%Event{title: title} = event) do
     "event.json"
-    |> ObjectView.render(%{event: event})
+    |> ObjectView.render(%{event: %{event | title: HTMLFormatter.strip_tags(title)}})
     |> Jason.encode!()
   end
 end

lib/service/metadata/instance.ex

@@ -7,6 +7,7 @@ defmodule Mobilizon.Service.Metadata.Instance do
   alias Phoenix.HTML.Tag
 
   alias Mobilizon.Config
+  alias Mobilizon.Service.Formatter.HTML, as: HTMLFormatter
   alias Mobilizon.Web.Endpoint
 
   def build_tags do
@@ -40,7 +41,7 @@ defmodule Mobilizon.Service.Metadata.Instance do
 
   defp process_description(description) do
     description
-    |> HtmlSanitizeEx.strip_tags()
+    |> HTMLFormatter.strip_tags()
     |> String.slice(0..200)
     |> (&"#{&1}…").()
   end

lib/service/workers/build_search.ex

@@ -7,6 +7,7 @@ defmodule Mobilizon.Service.Workers.BuildSearch do
 
   alias Mobilizon.Events
   alias Mobilizon.Events.Event
+  alias Mobilizon.Service.Formatter.HTML
   alias Mobilizon.Storage.Repo
 
   use Mobilizon.Service.Workers.Helper, queue: "search"
@@ -44,7 +45,7 @@ defmodule Mobilizon.Service.Workers.BuildSearch do
       [
         event.id,
         event.title,
-        HtmlSanitizeEx.strip_tags(event.description),
+        HTML.strip_tags(event.description),
         get_tags_string(event)
       ]
     )

lib/web/templates/email/report.html.eex

@@ -66,7 +66,7 @@
             <h3><%= gettext "Comments" %></h3>
             <%= for comment <- @report.comments do %>
               <p style="margin: 0;">
-                <%= HtmlSanitizeEx.strip_tags(comment.text) %>
+                <%= Mobilizon.Service.Formatter.HTML.strip_tags(comment.text) %>
               </p>
             <% end %>
             <table cellspacing="0" cellpadding="0" border="0" width="100%" style="width: 100% !important;">

mix.exs

@@ -96,7 +96,6 @@ defmodule Mobilizon.Mixfile do
       {:http_signatures,
        git: "https://git.pleroma.social/pleroma/http_signatures.git",
        ref: "293d77bb6f4a67ac8bde1428735c3b42f22cbb30"},
-      {:html_sanitize_ex, "~> 1.4.0"},
       {:ex_cldr, "~> 2.0"},
       {:ex_cldr_dates_times, "~> 2.2"},
       {:ex_optimizer, "~> 0.1"},

test/graphql/api/report_test.exs

@@ -7,6 +7,7 @@ defmodule Mobilizon.GraphQL.API.ReportTest do
   alias Mobilizon.Conversations.Comment
   alias Mobilizon.Events.Event
   alias Mobilizon.Reports.{Note, Report}
+  alias Mobilizon.Service.Formatter.HTML
   alias Mobilizon.Users
   alias Mobilizon.Users.User
 
@@ -92,7 +93,7 @@ defmodule Mobilizon.GraphQL.API.ReportTest do
         _comment_2 = insert(:comment, actor: reported)
 
       comment = "This is really not acceptable, remote admin I don't know"
-      encoded_comment = HtmlSanitizeEx.strip_tags(comment)
+      encoded_comment = HTML.strip_tags(comment)
 
       assert {:ok, %Activity{} = flag_activity, _} =
                Reports.report(%{

test/graphql/resolvers/event_test.exs

@@ -193,7 +193,7 @@ defmodule Mobilizon.Web.Resolvers.EventTest do
       )
     end
 
-    test "create_event/3 creates an event and escapes title and description", %{
+    test "create_event/3 creates an event and escapes title", %{
       conn: conn,
       actor: actor,
       user: user
@@ -214,7 +214,9 @@ defmodule Mobilizon.Web.Resolvers.EventTest do
         )
 
       assert res["errors"] == nil
-      assert res["data"]["createEvent"]["title"] == "My Event title"
+
+      assert res["data"]["createEvent"]["title"] ==
+               "My Event title <img src=\"http://placekitten.com/g/200/300\" onclick=\"alert('aaa')\" >"
 
       assert res["data"]["createEvent"]["description"] ==
                "<b>My description</b> <img src=\"http://placekitten.com/g/200/300\"/>"