Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix sanitizer config - multiple rules #11133

Merged
merged 8 commits into from
Apr 29, 2020
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Sanitizer Rules -- additional documentation
Signed-off-by: Alexander Scheel <[email protected]>
  • Loading branch information
cipherboy committed Apr 21, 2020
commit 5226e1547dedf8e5f40b13a1b9ba4447a6d45721
4 changes: 2 additions & 2 deletions custom/conf/app.ini.sample
Original file line number Diff line number Diff line change
Expand Up @@ -965,8 +965,8 @@ SHOW_FOOTER_TEMPLATE_LOAD_TIME = true

[markup.sanitizer.1]
; The following keys can appear once to define a sanitation policy rule.
; This section can appear with an incremenented number to define multiple rules.
; e.g., [markup.sanitizer.1] -> [markup.sanitizer.2]
; This section can appear again with a unique alphanmuric string to define multiple rules.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
; This section can appear again with a unique alphanmuric string to define multiple rules.
; This section can appear multiple times by adding a unique alphanumeric suffix to define multiple rules.

; e.g., [markup.sanitizer.1] -> [markup.sanitizer.2] -> [markup.sanitizer.TeX]
;ELEMENT = span
;ALLOW_ATTR = class
;REGEXP = ^(info|warning|error)$
Expand Down
4 changes: 2 additions & 2 deletions docs/content/doc/advanced/config-cheat-sheet.en-us.md
Original file line number Diff line number Diff line change
Expand Up @@ -658,8 +658,8 @@ REGEXP = ^\s*((math(\s+|$)|inline(\s+|$)|display(\s+|$)))+
- `ALLOW_ATTR`: The attribute this policy allows. Must be non-empty.
- `REGEXP`: A regex to match the contents of the attribute against. Must be present but may be empty for unconditional whitelisting of this attribute.

**Note**: The above section naming policy is new; previously the section was `[markup.sanitizer]` and keys could be redefined.
Now, a unique identifier must appear in the section name (e.g., `[markup.sanitizer.TeX]`) in order to parse multiple rules.
**Note**: The above section naming policy is new to v1.12.0; previously the section was `[markup.sanitizer]` and keys could be redefined in v1.11.0.
Now, a unique identifier must appear in the section name (e.g., `[markup.sanitizer.TeX]`) in order to parse multiple rules and keys cannot be duplicated.
This was changed because the implementation with the ini parser used was flawed; the following configs were indistinguishable after parsing:

```ini
Expand Down
1 change: 1 addition & 0 deletions docs/content/doc/advanced/external-renderers.en-us.md
Original file line number Diff line number Diff line change
Expand Up @@ -94,3 +94,4 @@ These can be numbers, identifying names, or anything else.
Once your configuration changes have been made, restart Gitea to have changes take effect.

**Note**: The above section numbering policy is new; previously the section was `[markup.sanitizer]` and keys could be redefined.
For more information, see the corresponding information in the cheat sheet.