From 9fca911718e0b0c277669241da6c79e8e05c9c5c Mon Sep 17 00:00:00 2001 From: Umar Getagazov Date: Fri, 18 Feb 2022 15:57:15 +0700 Subject: [PATCH] Use Content-Security-Policy And remove inline event handlers. --- static/toolbar.js | 36 ++++- views/mutators.qtpl | 58 +++---- views/mutators.qtpl.go | 352 ++++++++++++++++++++--------------------- web/web.go | 3 + 4 files changed, 230 insertions(+), 219 deletions(-) diff --git a/static/toolbar.js b/static/toolbar.js index 3da99f1..0fdd5c9 100644 --- a/static/toolbar.js +++ b/static/toolbar.js @@ -93,8 +93,8 @@ function insertDate() { } function insertTimeUTC() { - let time = new Date().toISOString().substring(11, 19) + " UTC" - textInserter(time)() + let time = new Date().toISOString().substring(11, 19) + " UTC" + textInserter(time)() } function insertUserlink() { @@ -102,3 +102,35 @@ function insertUserlink() { const userHypha = userlink.getAttribute('href').substring(7) // no /hypha/ textInserter('[[' + userHypha + ']]')() } + +const buttonsHandlers = { + link: wrapLink, + titlelink: wrapTitleLink, + heading1: insertHeading1, + heading2: insertHeading2, + bold: wrapBold, + italic: wrapItalic, + highlighted: wrapHighlighted, + underline: wrapUnderline, + monospace: wrapMonospace, + lifted: wrapLifted, + lowered: wrapLowered, + strikethrough: wrapStrikethrough, + rocket: insertRocket, + xcl: insertXcl, + img: insertImgBlock, + table: insertTableBlock, + hr: insertHorizontalBar, + codeblock: insertCodeblock, + bulletedlist: insertBulletedList, + numberedlist: insertNumberedList, + date: insertDate, + time: insertTimeUTC, + 'user-link': insertUserlink, +} +for (const key of Object.keys(buttonsHandlers)) { + const button = document.getElementsByClassName(`edit-toolbar__${key}`)[0] + if (button) { + button.addEventListener('click', buttonsHandlers[key]) + } +} diff --git a/views/mutators.qtpl b/views/mutators.qtpl index 4742a41..25c7a15 100644 --- a/views/mutators.qtpl +++ b/views/mutators.qtpl @@ -11,33 +11,30 @@
{% for _, el := range []struct{ class string - onclick string display string }{ - {"link", "wrapLink()", fmt.Sprintf("[[%s]]", lc.Get("edit.link"))}, - {"titlelink", "wrapTitleLink()", fmt.Sprintf("[[%s | %s]]", lc.Get("edit.link"), lc.Get("edit.link_title"))}, - {"heading1", "insertHeading1()", fmt.Sprintf("= %s", lc.Get("edit.heading"))}, - {"heading2", "insertHeading2()", fmt.Sprintf("== %s", lc.Get("edit.heading"))}, - {"bold", "wrapBold()", fmt.Sprintf("**%s**", lc.Get("edit.bold"))}, - {"italic", "wrapItalic()", fmt.Sprintf("//%s//", lc.Get("edit.italic"))}, - {"highlighted", "wrapHighlighted()", fmt.Sprintf("++%s++", lc.Get("edit.highlight"))}, - {"underline", "wrapUnderline()", fmt.Sprintf("__%s__", lc.Get("edit.underline"))}, - {"monospace", "wrapMonospace()", fmt.Sprintf("`%s`", lc.Get("edit.mono"))}, - {"lifted", "wrapLifted()", fmt.Sprintf("^^%s^^", lc.Get("edit.super"))}, // inconsistent names: lifted, supertext. How cute ❤️ - {"lowered", "wrapLowered()", fmt.Sprintf(",,%s,,", lc.Get("edit.sub"))}, - {"strikethrough", "wrapStrikethrough()", fmt.Sprintf("~~%s~~", lc.Get("edit.strike"))}, - {"rocket", "insertRocket()", "=> " + lc.Get("edit.rocket")}, - {"xcl", "insertXcl()", "<= " + lc.Get("edit.transclude")}, - {"img", "insertImgBlock()", "img {}"}, - {"table", "insertTableBlock()", "table {}"}, - {"hr", "insertHorizontalBar()", lc.Get("edit.hr")}, - {"codeblock", "insertCodeblock()", lc.Get("edit.code")}, - {"bulletedlist", "insertBulletedList()", "* " + lc.Get("edit.bullets")}, - {"numberedlist", "insertNumberedList()", "*. " + lc.Get("edit.numbers")}, + {"link", fmt.Sprintf("[[%s]]", lc.Get("edit.link"))}, + {"titlelink", fmt.Sprintf("[[%s | %s]]", lc.Get("edit.link"), lc.Get("edit.link_title"))}, + {"heading1", fmt.Sprintf("= %s", lc.Get("edit.heading"))}, + {"heading2", fmt.Sprintf("== %s", lc.Get("edit.heading"))}, + {"bold", fmt.Sprintf("**%s**", lc.Get("edit.bold"))}, + {"italic", fmt.Sprintf("//%s//", lc.Get("edit.italic"))}, + {"highlighted", fmt.Sprintf("++%s++", lc.Get("edit.highlight"))}, + {"underline", fmt.Sprintf("__%s__", lc.Get("edit.underline"))}, + {"monospace", fmt.Sprintf("`%s`", lc.Get("edit.mono"))}, + {"lifted", fmt.Sprintf("^^%s^^", lc.Get("edit.super"))}, // inconsistent names: lifted, supertext. How cute ❤️ + {"lowered", fmt.Sprintf(",,%s,,", lc.Get("edit.sub"))}, + {"strikethrough", fmt.Sprintf("~~%s~~", lc.Get("edit.strike"))}, + {"rocket", "=> " + lc.Get("edit.rocket")}, + {"xcl", "<= " + lc.Get("edit.transclude")}, + {"img", "img {}"}, + {"table", "table {}"}, + {"hr", lc.Get("edit.hr")}, + {"codeblock", lc.Get("edit.code")}, + {"bulletedlist", "* " + lc.Get("edit.bullets")}, + {"numberedlist", "*. " + lc.Get("edit.numbers")}, } %} - {% endfor %} @@ -49,22 +46,17 @@
{% for _, el := range []struct{ class string - onclick string display string }{ - {"date", "insertDate()", lc.Get("edit.date")}, - {"time", "insertTimeUTC()", lc.Get("edit.time")}, + {"date", lc.Get("edit.date")}, + {"time", lc.Get("edit.time")}, } %} - {% endfor %} {% if u.Group != "anon" %} - {% endif %} diff --git a/views/mutators.qtpl.go b/views/mutators.qtpl.go index 974b338..a6b28f0 100644 --- a/views/mutators.qtpl.go +++ b/views/mutators.qtpl.go @@ -47,420 +47,404 @@ func StreamToolbar(qw422016 *qt422016.Writer, u *user.User, lc *l18n.Localizer) //line views/mutators.qtpl:12 for _, el := range []struct { class string - onclick string display string }{ - {"link", "wrapLink()", fmt.Sprintf("[[%s]]", lc.Get("edit.link"))}, - {"titlelink", "wrapTitleLink()", fmt.Sprintf("[[%s | %s]]", lc.Get("edit.link"), lc.Get("edit.link_title"))}, - {"heading1", "insertHeading1()", fmt.Sprintf("= %s", lc.Get("edit.heading"))}, - {"heading2", "insertHeading2()", fmt.Sprintf("== %s", lc.Get("edit.heading"))}, - {"bold", "wrapBold()", fmt.Sprintf("**%s**", lc.Get("edit.bold"))}, - {"italic", "wrapItalic()", fmt.Sprintf("//%s//", lc.Get("edit.italic"))}, - {"highlighted", "wrapHighlighted()", fmt.Sprintf("++%s++", lc.Get("edit.highlight"))}, - {"underline", "wrapUnderline()", fmt.Sprintf("__%s__", lc.Get("edit.underline"))}, - {"monospace", "wrapMonospace()", fmt.Sprintf("`%s`", lc.Get("edit.mono"))}, - {"lifted", "wrapLifted()", fmt.Sprintf("^^%s^^", lc.Get("edit.super"))}, // inconsistent names: lifted, supertext. How cute ❤️ - {"lowered", "wrapLowered()", fmt.Sprintf(",,%s,,", lc.Get("edit.sub"))}, - {"strikethrough", "wrapStrikethrough()", fmt.Sprintf("~~%s~~", lc.Get("edit.strike"))}, - {"rocket", "insertRocket()", "=> " + lc.Get("edit.rocket")}, - {"xcl", "insertXcl()", "<= " + lc.Get("edit.transclude")}, - {"img", "insertImgBlock()", "img {}"}, - {"table", "insertTableBlock()", "table {}"}, - {"hr", "insertHorizontalBar()", lc.Get("edit.hr")}, - {"codeblock", "insertCodeblock()", lc.Get("edit.code")}, - {"bulletedlist", "insertBulletedList()", "* " + lc.Get("edit.bullets")}, - {"numberedlist", "insertNumberedList()", "*. " + lc.Get("edit.numbers")}, + {"link", fmt.Sprintf("[[%s]]", lc.Get("edit.link"))}, + {"titlelink", fmt.Sprintf("[[%s | %s]]", lc.Get("edit.link"), lc.Get("edit.link_title"))}, + {"heading1", fmt.Sprintf("= %s", lc.Get("edit.heading"))}, + {"heading2", fmt.Sprintf("== %s", lc.Get("edit.heading"))}, + {"bold", fmt.Sprintf("**%s**", lc.Get("edit.bold"))}, + {"italic", fmt.Sprintf("//%s//", lc.Get("edit.italic"))}, + {"highlighted", fmt.Sprintf("++%s++", lc.Get("edit.highlight"))}, + {"underline", fmt.Sprintf("__%s__", lc.Get("edit.underline"))}, + {"monospace", fmt.Sprintf("`%s`", lc.Get("edit.mono"))}, + {"lifted", fmt.Sprintf("^^%s^^", lc.Get("edit.super"))}, // inconsistent names: lifted, supertext. How cute ❤️ + {"lowered", fmt.Sprintf(",,%s,,", lc.Get("edit.sub"))}, + {"strikethrough", fmt.Sprintf("~~%s~~", lc.Get("edit.strike"))}, + {"rocket", "=> " + lc.Get("edit.rocket")}, + {"xcl", "<= " + lc.Get("edit.transclude")}, + {"img", "img {}"}, + {"table", "table {}"}, + {"hr", lc.Get("edit.hr")}, + {"codeblock", lc.Get("edit.code")}, + {"bulletedlist", "* " + lc.Get("edit.bullets")}, + {"numberedlist", "*. " + lc.Get("edit.numbers")}, } { -//line views/mutators.qtpl:37 +//line views/mutators.qtpl:36 qw422016.N().S(` - `) -//line views/mutators.qtpl:43 +//line views/mutators.qtpl:40 } -//line views/mutators.qtpl:43 +//line views/mutators.qtpl:40 qw422016.N().S(`

`) -//line views/mutators.qtpl:45 +//line views/mutators.qtpl:42 qw422016.N().S(lc.Get("edit.help", &l18n.Replacements{"link": fmt.Sprintf("%s", lc.Get("edit.help_link"))})) -//line views/mutators.qtpl:45 +//line views/mutators.qtpl:42 qw422016.N().S(`

`) -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 } -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 func WriteToolbar(qq422016 qtio422016.Writer, u *user.User, lc *l18n.Localizer) { -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 qw422016 := qt422016.AcquireWriter(qq422016) -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 StreamToolbar(qw422016, u, lc) -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 qt422016.ReleaseWriter(qw422016) -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 } -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 func Toolbar(u *user.User, lc *l18n.Localizer) string { -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 qb422016 := qt422016.AcquireByteBuffer() -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 WriteToolbar(qb422016, u, lc) -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 qs422016 := string(qb422016.B) -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 qt422016.ReleaseByteBuffer(qb422016) -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 return qs422016 -//line views/mutators.qtpl:74 +//line views/mutators.qtpl:66 } -//line views/mutators.qtpl:76 +//line views/mutators.qtpl:68 func StreamEditHTML(qw422016 *qt422016.Writer, rq *http.Request, hyphaName, textAreaFill, warning string) { -//line views/mutators.qtpl:76 +//line views/mutators.qtpl:68 qw422016.N().S(` `) -//line views/mutators.qtpl:78 +//line views/mutators.qtpl:70 lc := l18n.FromRequest(rq) -//line views/mutators.qtpl:79 +//line views/mutators.qtpl:71 qw422016.N().S(`

`) -//line views/mutators.qtpl:82 +//line views/mutators.qtpl:74 qw422016.N().S(fmt.Sprintf(lc.Get("edit.title"), beautifulLink(hyphaName))) -//line views/mutators.qtpl:82 +//line views/mutators.qtpl:74 qw422016.N().S(`

`) -//line views/mutators.qtpl:83 +//line views/mutators.qtpl:75 qw422016.N().S(warning) -//line views/mutators.qtpl:83 +//line views/mutators.qtpl:75 qw422016.N().S(`





`) -//line views/mutators.qtpl:93 +//line views/mutators.qtpl:85 qw422016.E().S(lc.Get("ui.cancel")) -//line views/mutators.qtpl:93 +//line views/mutators.qtpl:85 qw422016.N().S(`
`) -//line views/mutators.qtpl:96 +//line views/mutators.qtpl:88 qw422016.N().S(Toolbar(user.FromRequest(rq), lc)) -//line views/mutators.qtpl:96 +//line views/mutators.qtpl:88 qw422016.N().S(`
`) -//line views/mutators.qtpl:98 +//line views/mutators.qtpl:90 streameditScripts(qw422016) -//line views/mutators.qtpl:98 +//line views/mutators.qtpl:90 qw422016.N().S(` `) -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 } -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 func WriteEditHTML(qq422016 qtio422016.Writer, rq *http.Request, hyphaName, textAreaFill, warning string) { -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 qw422016 := qt422016.AcquireWriter(qq422016) -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 StreamEditHTML(qw422016, rq, hyphaName, textAreaFill, warning) -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 qt422016.ReleaseWriter(qw422016) -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 } -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 func EditHTML(rq *http.Request, hyphaName, textAreaFill, warning string) string { -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 qb422016 := qt422016.AcquireByteBuffer() -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 WriteEditHTML(qb422016, rq, hyphaName, textAreaFill, warning) -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 qs422016 := string(qb422016.B) -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 qt422016.ReleaseByteBuffer(qb422016) -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 return qs422016 -//line views/mutators.qtpl:99 +//line views/mutators.qtpl:91 } -//line views/mutators.qtpl:101 +//line views/mutators.qtpl:93 func StreamPreviewHTML(qw422016 *qt422016.Writer, rq *http.Request, hyphaName, textAreaFill, message, warning string, renderedPage string) { -//line views/mutators.qtpl:101 +//line views/mutators.qtpl:93 qw422016.N().S(` `) -//line views/mutators.qtpl:103 +//line views/mutators.qtpl:95 lc := l18n.FromRequest(rq) -//line views/mutators.qtpl:104 +//line views/mutators.qtpl:96 qw422016.N().S(`

`) -//line views/mutators.qtpl:107 +//line views/mutators.qtpl:99 qw422016.N().S(fmt.Sprintf(lc.Get("edit.title"), beautifulLink(hyphaName))) -//line views/mutators.qtpl:107 +//line views/mutators.qtpl:99 qw422016.N().S(`

`) -//line views/mutators.qtpl:108 +//line views/mutators.qtpl:100 qw422016.N().S(warning) -//line views/mutators.qtpl:108 +//line views/mutators.qtpl:100 qw422016.N().S(`





`) -//line views/mutators.qtpl:118 +//line views/mutators.qtpl:110 qw422016.E().S(lc.Get("ui.cancel")) -//line views/mutators.qtpl:118 +//line views/mutators.qtpl:110 qw422016.N().S(`

`) -//line views/mutators.qtpl:120 +//line views/mutators.qtpl:112 qw422016.E().S(lc.Get("edit.preview_tip")) -//line views/mutators.qtpl:120 +//line views/mutators.qtpl:112 qw422016.N().S(`

`) -//line views/mutators.qtpl:121 +//line views/mutators.qtpl:113 qw422016.N().S(renderedPage) -//line views/mutators.qtpl:121 +//line views/mutators.qtpl:113 qw422016.N().S(`
`) -//line views/mutators.qtpl:123 +//line views/mutators.qtpl:115 qw422016.N().S(Toolbar(user.FromRequest(rq), lc)) -//line views/mutators.qtpl:123 +//line views/mutators.qtpl:115 qw422016.N().S(`
`) -//line views/mutators.qtpl:125 +//line views/mutators.qtpl:117 streameditScripts(qw422016) -//line views/mutators.qtpl:125 +//line views/mutators.qtpl:117 qw422016.N().S(` `) -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 } -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 func WritePreviewHTML(qq422016 qtio422016.Writer, rq *http.Request, hyphaName, textAreaFill, message, warning string, renderedPage string) { -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 qw422016 := qt422016.AcquireWriter(qq422016) -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 StreamPreviewHTML(qw422016, rq, hyphaName, textAreaFill, message, warning, renderedPage) -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 qt422016.ReleaseWriter(qw422016) -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 } -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 func PreviewHTML(rq *http.Request, hyphaName, textAreaFill, message, warning string, renderedPage string) string { -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 qb422016 := qt422016.AcquireByteBuffer() -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 WritePreviewHTML(qb422016, rq, hyphaName, textAreaFill, message, warning, renderedPage) -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 qs422016 := string(qb422016.B) -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 qt422016.ReleaseByteBuffer(qb422016) -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 return qs422016 -//line views/mutators.qtpl:126 +//line views/mutators.qtpl:118 } -//line views/mutators.qtpl:128 +//line views/mutators.qtpl:120 func streameditScripts(qw422016 *qt422016.Writer) { -//line views/mutators.qtpl:128 +//line views/mutators.qtpl:120 qw422016.N().S(` `) -//line views/mutators.qtpl:130 +//line views/mutators.qtpl:122 for _, scriptPath := range cfg.EditScripts { -//line views/mutators.qtpl:130 +//line views/mutators.qtpl:122 qw422016.N().S(` `) -//line views/mutators.qtpl:132 +//line views/mutators.qtpl:124 } -//line views/mutators.qtpl:132 +//line views/mutators.qtpl:124 qw422016.N().S(` `) -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 } -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 func writeeditScripts(qq422016 qtio422016.Writer) { -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 qw422016 := qt422016.AcquireWriter(qq422016) -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 streameditScripts(qw422016) -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 qt422016.ReleaseWriter(qw422016) -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 } -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 func editScripts() string { -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 qb422016 := qt422016.AcquireByteBuffer() -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 writeeditScripts(qb422016) -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 qs422016 := string(qb422016.B) -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 qt422016.ReleaseByteBuffer(qb422016) -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 return qs422016 -//line views/mutators.qtpl:133 +//line views/mutators.qtpl:125 } diff --git a/web/web.go b/web/web.go index 41afc4d..0362601 100644 --- a/web/web.go +++ b/web/web.go @@ -80,6 +80,9 @@ func Handler() http.Handler { router.Use(func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, rq *http.Request) { util.PrepareRq(rq) + w.Header().Add("Content-Security-Policy", + "default-src 'self' telegram.org *.telegram.org; "+ + "img-src * data:; media-src *; style-src *; font-src * data:") next.ServeHTTP(w, rq) }) })