Html whitelist

[bricesanchez]

This PR replaces #3154, it's just a rebase on master.

[anitagraham]

Thankyou for the rescue @bricesanchez

[bricesanchez]

You're welcome!

[bricesanchez]

@parndt, it's ready to be merged if you're ok.

[sintro]

Ok, and how I can remove some elements from whitelist? If I want to disable the possibility of including <script> in pages body for example?

[parndt]

<script> tags should already be disabled?

[anitagraham]

Well I suppose, if it were required we could include a blacklist if there was a demand (taking @parndt 's comment into consideration).

[sintro]

@parndt , I just tried to save <script>alert('hello')</script>; (by switching to HTML editor), and after that I successfully alerted when opened that page.
By reading this

refinerycms/pages/lib/refinery/pages/configuration.rb

Line 32 in c793da0

Loofah::HTML5::WhiteList::ALLOWED_ELEMENTS.merge(config.add_whitelist_elements)

line I see, that there are only Loofah::HTML5::WhiteList::ALLOWED_ELEMENTS whitelisted elements, which does not include 'script' tag. So I am sure it is rendered by =raw @page.content_for(:body), which I use in page`s template. Probably, to prevent script from being displayed I should use more complex way of rendering, like it is in

refinerycms/pages/app/presenters/refinery/pages/section_presenter.rb

Line 71 in c793da0

def sanitize_content(input)

, but the question is actual anyway - what if I want to remove some of these https://github.com/flavorjones/loofah/blob/2b2b5aa184d6127ac666931112faa6370f01a389/lib/loofah/html5/whitelist.rb#L49 tags?

[bricesanchez]

@sintro

Loofah::HTML5::WhiteList::ALLOWED_ELEMENTS whitelisted elements, which does not include 'script'

Which is not explicitly whitelisted is forbidden.

So I am sure it is rendered by =raw @page.content_for(:body)

The HTML sanitizer is for frontend only, so <script> tags could be recorded in backend but they won't rendered in frontend.

[sintro]

@bricesanchez , exactly, that is what I have noticed in #3164 (comment), but the question is still here: what if I want to disable some of ALLOWED_ELEMENTS`s default tags?

[bricesanchez]

@sintro Ok, i understand. So you will have to override the Refinery::Pages configurable class if you want to disable more tags in frontend :

refinerycms/pages/lib/refinery/pages/configuration.rb

Lines 31 to 33 in c793da0

	def whitelist_elements
	Loofah::HTML5::WhiteList::ALLOWED_ELEMENTS.merge(config.add_whitelist_elements)
	end