 b01dce2a6e
			
		
	
	
		b01dce2a6e
		
			
		
	
	
	
	
		
			
			* Allow render HTML with css/js external links * Fix bug because of filename escape chars * Fix lint * Update docs about new configuration item * Fix bug of render HTML in sub directory * Add CSP head for displaying iframe in rendering file * Fix test * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Some improvements * some improvement * revert change in SanitizerDisabled of external renderer * Add sandbox for iframe and support allow-scripts and allow-same-origin * refactor * fix * fix lint * fine tune * use single option RENDER_CONTENT_MODE, use sandbox=allow-scripts * fine tune CSP * Apply suggestions from code review Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
		
			
				
	
	
		
			143 lines
		
	
	
	
		
			3.3 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			143 lines
		
	
	
	
		
			3.3 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
| // Copyright 2018 The Gitea Authors. All rights reserved.
 | |
| // Use of this source code is governed by a MIT-style
 | |
| // license that can be found in the LICENSE file.
 | |
| 
 | |
| package markup
 | |
| 
 | |
| import (
 | |
| 	"bufio"
 | |
| 	"bytes"
 | |
| 	"html"
 | |
| 	"io"
 | |
| 	"regexp"
 | |
| 	"strconv"
 | |
| 
 | |
| 	"code.gitea.io/gitea/modules/csv"
 | |
| 	"code.gitea.io/gitea/modules/markup"
 | |
| 	"code.gitea.io/gitea/modules/setting"
 | |
| )
 | |
| 
 | |
| func init() {
 | |
| 	markup.RegisterRenderer(Renderer{})
 | |
| }
 | |
| 
 | |
| // Renderer implements markup.Renderer for csv files
 | |
| type Renderer struct{}
 | |
| 
 | |
| // Name implements markup.Renderer
 | |
| func (Renderer) Name() string {
 | |
| 	return "csv"
 | |
| }
 | |
| 
 | |
| // Extensions implements markup.Renderer
 | |
| func (Renderer) Extensions() []string {
 | |
| 	return []string{".csv", ".tsv"}
 | |
| }
 | |
| 
 | |
| // SanitizerRules implements markup.Renderer
 | |
| func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
 | |
| 	return []setting.MarkupSanitizerRule{
 | |
| 		{Element: "table", AllowAttr: "class", Regexp: regexp.MustCompile(`data-table`)},
 | |
| 		{Element: "th", AllowAttr: "class", Regexp: regexp.MustCompile(`line-num`)},
 | |
| 		{Element: "td", AllowAttr: "class", Regexp: regexp.MustCompile(`line-num`)},
 | |
| 	}
 | |
| }
 | |
| 
 | |
| func writeField(w io.Writer, element, class, field string) error {
 | |
| 	if _, err := io.WriteString(w, "<"); err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 	if _, err := io.WriteString(w, element); err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 	if len(class) > 0 {
 | |
| 		if _, err := io.WriteString(w, " class=\""); err != nil {
 | |
| 			return err
 | |
| 		}
 | |
| 		if _, err := io.WriteString(w, class); err != nil {
 | |
| 			return err
 | |
| 		}
 | |
| 		if _, err := io.WriteString(w, "\""); err != nil {
 | |
| 			return err
 | |
| 		}
 | |
| 	}
 | |
| 	if _, err := io.WriteString(w, ">"); err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 	if _, err := io.WriteString(w, html.EscapeString(field)); err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 	if _, err := io.WriteString(w, "</"); err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 	if _, err := io.WriteString(w, element); err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 	_, err := io.WriteString(w, ">")
 | |
| 	return err
 | |
| }
 | |
| 
 | |
| // Render implements markup.Renderer
 | |
| func (Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
 | |
| 	tmpBlock := bufio.NewWriter(output)
 | |
| 
 | |
| 	// FIXME: don't read all to memory
 | |
| 	rawBytes, err := io.ReadAll(input)
 | |
| 	if err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 
 | |
| 	if setting.UI.CSV.MaxFileSize != 0 && setting.UI.CSV.MaxFileSize < int64(len(rawBytes)) {
 | |
| 		if _, err := tmpBlock.WriteString("<pre>"); err != nil {
 | |
| 			return err
 | |
| 		}
 | |
| 		if _, err := tmpBlock.WriteString(html.EscapeString(string(rawBytes))); err != nil {
 | |
| 			return err
 | |
| 		}
 | |
| 		_, err = tmpBlock.WriteString("</pre>")
 | |
| 		return err
 | |
| 	}
 | |
| 
 | |
| 	rd, err := csv.CreateReaderAndDetermineDelimiter(ctx, bytes.NewReader(rawBytes))
 | |
| 	if err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 
 | |
| 	if _, err := tmpBlock.WriteString(`<table class="data-table">`); err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 	row := 1
 | |
| 	for {
 | |
| 		fields, err := rd.Read()
 | |
| 		if err == io.EOF {
 | |
| 			break
 | |
| 		}
 | |
| 		if err != nil {
 | |
| 			continue
 | |
| 		}
 | |
| 		if _, err := tmpBlock.WriteString("<tr>"); err != nil {
 | |
| 			return err
 | |
| 		}
 | |
| 		element := "td"
 | |
| 		if row == 1 {
 | |
| 			element = "th"
 | |
| 		}
 | |
| 		if err := writeField(tmpBlock, element, "line-num", strconv.Itoa(row)); err != nil {
 | |
| 			return err
 | |
| 		}
 | |
| 		for _, field := range fields {
 | |
| 			if err := writeField(tmpBlock, element, "", field); err != nil {
 | |
| 				return err
 | |
| 			}
 | |
| 		}
 | |
| 		if _, err := tmpBlock.WriteString("</tr>"); err != nil {
 | |
| 			return err
 | |
| 		}
 | |
| 
 | |
| 		row++
 | |
| 	}
 | |
| 	if _, err = tmpBlock.WriteString("</table>"); err != nil {
 | |
| 		return err
 | |
| 	}
 | |
| 	return tmpBlock.Flush()
 | |
| }
 |