diff --git a/CTFd/config.ini b/CTFd/config.ini index 1df2f997..f9e2ba4f 100644 --- a/CTFd/config.ini +++ b/CTFd/config.ini @@ -40,6 +40,7 @@ SWAGGER_UI = UPDATE_CHECK = APPLICATION_ROOT = SERVER_SENT_EVENTS = +HTML_SANITIZATION = SQLALCHEMY_MAX_OVERFLOW = SQLALCHEMY_POOL_PRE_PING = diff --git a/CTFd/config.py b/CTFd/config.py index 962e6e67..3cfd58b7 100644 --- a/CTFd/config.py +++ b/CTFd/config.py @@ -297,6 +297,9 @@ class Config(object): Specifies what path CTFd is mounted under. It can be used to run CTFd in a subdirectory. Example: /ctfd + HTML_SANITIZATION: + Specifies whether CTFd should sanitize HTML content from pages and descriptions + SERVER_SENT_EVENTS: Specifies whether or not to enable to server-sent events based Notifications system. @@ -335,6 +338,10 @@ class Config(object): or empty_str_cast(config_ini["optional"]["SERVER_SENT_EVENTS"]) \ or True + HTML_SANITIZATION: bool = process_boolean_str(os.getenv("HTML_SANITIZATION")) \ + or empty_str_cast(config_ini["optional"]["HTML_SANITIZATION"]) \ + or False + if DATABASE_URL.startswith("sqlite") is False: SQLALCHEMY_ENGINE_OPTIONS = { "max_overflow": int(os.getenv("SQLALCHEMY_MAX_OVERFLOW", 0)) diff --git a/CTFd/utils/config/pages.py b/CTFd/utils/config/pages.py index 2f9d063c..ac099967 100644 --- a/CTFd/utils/config/pages.py +++ b/CTFd/utils/config/pages.py @@ -1,3 +1,5 @@ +from flask import current_app + from CTFd.cache import cache from CTFd.models import Pages, db from CTFd.utils import markdown @@ -6,7 +8,8 @@ from CTFd.utils.security.sanitize import sanitize_html def build_html(html): html = markdown(html) - html = sanitize_html(html) + if current_app.config["HTML_SANITIZATION"] is True: + html = sanitize_html(html) return html