aljaz/CTFd
1
0
Fork 0
mirror of https://github.com/aljazceru/CTFd.git synced 2025-12-17 14:04:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make HTML sanitization an optional setting (#1556)

Browse Source 
* Add new `HTML_SANITIZATION` server config to make HTML sanitization optional
This commit is contained in:
Kevin Chung
2020-07-19 21:56:53 -04:00
committed by GitHub
parent 559306ee4f
commit a1e4f15bdc
3 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CTFd/config.ini
View File

@@ -40,6 +40,7 @@ SWAGGER_UI =
UPDATE_CHECK = UPDATE_CHECK =
APPLICATION_ROOT = APPLICATION_ROOT =
SERVER_SENT_EVENTS = SERVER_SENT_EVENTS =
HTML_SANITIZATION =
SQLALCHEMY_MAX_OVERFLOW = SQLALCHEMY_MAX_OVERFLOW =
SQLALCHEMY_POOL_PRE_PING = SQLALCHEMY_POOL_PRE_PING =

7
CTFd/config.py
View File

@@ -297,6 +297,9 @@ class Config(object):
Specifies what path CTFd is mounted under. It can be used to run CTFd in a subdirectory. Specifies what path CTFd is mounted under. It can be used to run CTFd in a subdirectory.
Example: /ctfd Example: /ctfd
HTML_SANITIZATION:
Specifies whether CTFd should sanitize HTML content from pages and descriptions
SERVER_SENT_EVENTS: SERVER_SENT_EVENTS:
Specifies whether or not to enable to server-sent events based Notifications system. Specifies whether or not to enable to server-sent events based Notifications system.
@@ -335,6 +338,10 @@ class Config(object):
or empty_str_cast(config_ini["optional"]["SERVER_SENT_EVENTS"]) \ or empty_str_cast(config_ini["optional"]["SERVER_SENT_EVENTS"]) \
or True or True
HTML_SANITIZATION: bool = process_boolean_str(os.getenv("HTML_SANITIZATION")) \
or empty_str_cast(config_ini["optional"]["HTML_SANITIZATION"]) \
or False
if DATABASE_URL.startswith("sqlite") is False: if DATABASE_URL.startswith("sqlite") is False:
SQLALCHEMY_ENGINE_OPTIONS = { SQLALCHEMY_ENGINE_OPTIONS = {
"max_overflow": int(os.getenv("SQLALCHEMY_MAX_OVERFLOW", 0)) "max_overflow": int(os.getenv("SQLALCHEMY_MAX_OVERFLOW", 0))

3
CTFd/utils/config/pages.py
View File

@@ -1,3 +1,5 @@
from flask import current_app
from CTFd.cache import cache from CTFd.cache import cache
from CTFd.models import Pages, db from CTFd.models import Pages, db
from CTFd.utils import markdown from CTFd.utils import markdown
@@ -6,6 +8,7 @@ from CTFd.utils.security.sanitize import sanitize_html
def build_html(html): def build_html(html):
html = markdown(html) html = markdown(html)
if current_app.config["HTML_SANITIZATION"] is True:
html = sanitize_html(html) html = sanitize_html(html)
return html return html