Skip to content

Commit 4973bc3

Browse files
doshitandoshitan
committed
Allow HTML input in document content, but not comments
Summary: Documents will sometimes have structures we can't represent in Markdown directly, so we need to allow general HTML input as well. It's a dangerous thing to allow arbitrary HTML in comments though, so use a separate Markdown converter for those that strips HTML. Test Plan: - Put some HTML in the introtext and content of a document - Ensure it comes out the other side when rendered - Create a comment with some HTML in it - Ensure the HTML is stripped from the comment when rendered Reviewers: sethetter Reviewed By: sethetter Maniphest Tasks: T292 Differential Revision: https://phabricator.opengovfoundation.org/D178
1 parent b4d330c commit 4973bc3

File tree

4 files changed

+222
-2
lines changed

4 files changed

+222
-2
lines changed

‎app/Models/AnnotationTypes/Comment.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22

33
namespace App\Models\AnnotationTypes;
44

5+
use App;
56
use Cache;
6-
use GrahamCampbell\Markdown\Facades\Markdown;
77
use Illuminate\Database\Eloquent\Model;
88
use Illuminate\Database\Eloquent\SoftDeletes;
99

@@ -39,7 +39,7 @@ public function getContentHtmlAttribute()
3939
return Cache::get($cacheKey);
4040
}
4141

42-
$html = Markdown::convertToHtml($this->content);
42+
$html = App::make('comment_markdown')->convertToHtml($this->content);
4343
Cache::forever($cacheKey, $html);
4444

4545
return $html;

‎app/Providers/CommentMarkdownServiceProvider.php‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<?php
2+
3+
namespace App\Providers;
4+
5+
use Illuminate\Support\ServiceProvider;
6+
use League\CommonMark\Converter;
7+
use League\CommonMark\DocParser;
8+
use League\CommonMark\Environment;
9+
use League\CommonMark\HtmlRenderer;
10+
11+
class CommentMarkdownServiceProvider extends ServiceProvider
12+
{
13+
protected $defer = true;
14+
15+
/**
16+
* Register the service provider.
17+
*
18+
* @return void
19+
*/
20+
public function register()
21+
{
22+
$this->registerEnvironment();
23+
$this->registerMarkdown();
24+
}
25+
26+
/**
27+
* Register the environment class.
28+
*
29+
* @return void
30+
*/
31+
protected function registerEnvironment()
32+
{
33+
$this->app->singleton('comment_markdown.environment', function ($app) {
34+
// make our normal markdown environment
35+
$environment = Environment::createCommonMarkEnvironment();
36+
$config = $app->config->get('markdown');
37+
$environment->mergeConfig(array_except($config, ['extensions', 'views']));
38+
39+
// disable some things
40+
$environment->mergeConfig([
41+
'html_input' => 'strip',
42+
'allow_unsafe_links' => false,
43+
]);
44+
45+
foreach ((array) array_get($config, 'extensions') as $extension) {
46+
$environment->addExtension($app->make($extension));
47+
}
48+
49+
return $environment;
50+
});
51+
}
52+
53+
/**
54+
* Register the markdown class.
55+
*
56+
* @return void
57+
*/
58+
protected function registerMarkdown()
59+
{
60+
$this->app->singleton('comment_markdown', function ($app) {
61+
$environment = $app['comment_markdown.environment'];
62+
$docParser = new DocParser($environment);
63+
$htmlRenderer = new HtmlRenderer($environment);
64+
65+
return new Converter($docParser, $htmlRenderer);
66+
});
67+
}
68+
69+
public function provides()
70+
{
71+
return [
72+
'comment_markdown.environment',
73+
'comment_markdown',
74+
];
75+
}
76+
}

‎config/app.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,7 @@
177177
App\Providers\AnnotationsServiceProvider::class,
178178
App\Providers\DocumentsServiceProvider::class,
179179
App\Config\SiteConfigServiceProvider::class,
180+
App\Providers\CommentMarkdownServiceProvider::class,
180181

181182
/**
182183
* Vendor Providers...

‎config/markdown.php‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
<?php
2+
3+
/*
4+
* This file is part of Laravel Markdown.
5+
*
6+
* (c) Graham Campbell <graham@alt-three.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
return [
13+
14+
/*
15+
|--------------------------------------------------------------------------
16+
| Enable View Integration
17+
|--------------------------------------------------------------------------
18+
|
19+
| This option specifies if the view integration is enabled so you can write
20+
| markdown views and have them rendered as html. The following extensions
21+
| are currently supported: ".md", ".md.php", and ".md.blade.php". You may
22+
| disable this integration if it is conflicting with another package.
23+
|
24+
| Default: true
25+
|
26+
*/
27+
28+
'views' => true,
29+
30+
/*
31+
|--------------------------------------------------------------------------
32+
| CommonMark Extensions
33+
|--------------------------------------------------------------------------
34+
|
35+
| This option specifies what extensions will be automatically enabled.
36+
| Simply provide your extension class names here.
37+
|
38+
| Default: []
39+
|
40+
*/
41+
42+
'extensions' => [],
43+
44+
/*
45+
|--------------------------------------------------------------------------
46+
| Renderer Configuration
47+
|--------------------------------------------------------------------------
48+
|
49+
| This option specifies an array of options for rendering HTML.
50+
|
51+
| Default: [
52+
| 'block_separator' => "\n",
53+
| 'inner_separator' => "\n",
54+
| 'soft_break' => "\n",
55+
| ]
56+
|
57+
*/
58+
59+
'renderer' => [
60+
'block_separator' => "\n",
61+
'inner_separator' => "\n",
62+
'soft_break' => "\n",
63+
],
64+
65+
/*
66+
|--------------------------------------------------------------------------
67+
| Enable Em Tag Parsing
68+
|--------------------------------------------------------------------------
69+
|
70+
| This option specifies if `<em>` parsing is enabled.
71+
|
72+
| Default: true
73+
|
74+
*/
75+
76+
'enable_em' => true,
77+
78+
/*
79+
|--------------------------------------------------------------------------
80+
| Enable Strong Tag Parsing
81+
|--------------------------------------------------------------------------
82+
|
83+
| This option specifies if `<strong>` parsing is enabled.
84+
|
85+
| Default: true
86+
|
87+
*/
88+
89+
'enable_strong' => true,
90+
91+
/*
92+
|--------------------------------------------------------------------------
93+
| Enable Asterisk Parsing
94+
|--------------------------------------------------------------------------
95+
|
96+
| This option specifies if `*` should be parsed for emphasis.
97+
|
98+
| Default: true
99+
|
100+
*/
101+
102+
'use_asterisk' => true,
103+
104+
/*
105+
|--------------------------------------------------------------------------
106+
| Enable Underscore Parsing
107+
|--------------------------------------------------------------------------
108+
|
109+
| This option specifies if `_` should be parsed for emphasis.
110+
|
111+
| Default: true
112+
|
113+
*/
114+
115+
'use_underscore' => true,
116+
117+
/*
118+
|--------------------------------------------------------------------------
119+
| HTML Input
120+
|--------------------------------------------------------------------------
121+
|
122+
| This option specifies how to handle untrusted HTML input.
123+
|
124+
| Default: 'strip'
125+
|
126+
*/
127+
128+
'html_input' => 'allow',
129+
130+
/*
131+
|--------------------------------------------------------------------------
132+
| Allow Unsafe Links
133+
|--------------------------------------------------------------------------
134+
|
135+
| This option specifies whether to allow risky image URLs and links.
136+
|
137+
| Default: true
138+
|
139+
*/
140+
141+
'allow_unsafe_links' => true,
142+
143+
];

0 commit comments

Comments
 (0)