diff --git a/markdown.go b/markdown.go index a15b7e2..25af2b3 100644 --- a/markdown.go +++ b/markdown.go @@ -9,6 +9,7 @@ import ( "github.com/gomarkdown/markdown/ast" "github.com/gomarkdown/markdown/html" "github.com/gomarkdown/markdown/parser" + "github.com/microcosm-cc/bluemonday" ) var mdrenderer = html.NewRenderer(html.RendererOptions{ @@ -82,3 +83,12 @@ func mdToHTML(md string, usingTelegramInstantView bool) string { return output } + +func sanitizeXSS(html string) string { + p := bluemonday.UGCPolicy() + p.RequireNoFollowOnLinks(false) + p.AllowElements("video", "source") + p.AllowAttrs("controls", "width").OnElements("video") + p.AllowAttrs("src", "width").OnElements("source") + return p.Sanitize(html) +} diff --git a/utils.go b/utils.go index 54d810b..83e518b 100644 --- a/utils.go +++ b/utils.go @@ -14,7 +14,6 @@ import ( "sync" "time" - "github.com/microcosm-cc/bluemonday" "github.com/puzpuzpuz/xsync/v3" "mvdan.cc/xurls/v2" @@ -339,16 +338,6 @@ func linkQuotes(input string) string { }) } -func sanitizeXSS(html string) string { - p := bluemonday.UGCPolicy() - p.AllowStyling() - p.RequireNoFollowOnLinks(false) - p.AllowElements("video", "source") - p.AllowAttrs("controls", "width").OnElements("video") - p.AllowAttrs("src", "width").OnElements("source") - return p.Sanitize(html) -} - func basicFormatting(input string, skipNostrEventLinks bool, usingTelegramInstantView bool, skipLinks bool) string { nostrMatcher := nostrEveryMatcher if skipNostrEventLinks {