+ allowed_attributes = ["align", "href"] + attributes
+
+ # remove disallowed tokens from the output
+ def disallowed_token(self, token, token_type):
+ return None
+
+ return Inner
-def sanitize(document):
+def sanitize(tokenizer, document):
- parser = html5lib.HTMLParser(tokenizer=MarkdownSanitizer)
+ parser = html5lib.HTMLParser(tokenizer=tokenizer)
domtree = parser.parseFragment(document)
- builder = "simpletree" if html5lib.version == "0.95" else "etree"
+ builder = "simpletree" if html5lib_version == "0.95" else "etree"
stream = html5lib.treewalkers.getTreeWalker(builder)(domtree)
serializer = HTMLSerializer(quote_attr_values=True, omit_optional_tags=False)
return serializer.render(stream)
-def markdown(text):
- """Convert Markdown to (safe) HTML.
+def Markdown(extensions=("strikethrough", "superscript", "autolink")):
- >>> markdown("*Ohai!*") # doctest: +IGNORE_UNICODE
- 'Ohai!
'
- >>> markdown("Hi") # doctest: +IGNORE_UNICODE
- 'Hi
'
- >>> markdown("") # doctest: +IGNORE_UNICODE
- "alert('Onoe')
"
- >>> markdown("http://example.org/ and sms:+1234567890") # doctest: +IGNORE_UNICODE
- 'http://example.org/ and sms:+1234567890
'
- """
+ flags = reduce(operator.xor, map(
+ lambda ext: getattr(misaka, 'EXT_' + ext.upper()), extensions), 0)
- # ~~strike through~~, sub script: 2^(nd) and http://example.org/ auto-link
- exts = misaka.EXT_STRIKETHROUGH | misaka.EXT_SUPERSCRIPT | misaka.EXT_AUTOLINK
+ def inner(text):
+ rv = misaka.html(text, extensions=flags).rstrip("\n")
+ if not rv.endswith("") and not rv.endswith("
"):
+ return "" + rv + "
"
+ return rv
- # remove HTML tags, skip ![]()
(for now) and only render "safe" protocols
- html = misaka.HTML_SKIP_STYLE | misaka.HTML_SKIP_IMAGES | misaka.HTML_SAFELINK
+ return inner
- rv = misaka.html(text, extensions=exts, render_flags=html).rstrip("\n")
- if not rv.startswith("") and not rv.endswith("
"):
- rv = "" + rv + "
"
- return sanitize(rv)
+class Markup(object):
+
+ def __init__(self, conf):
+
+ parser = Markdown(conf.getlist("options"))
+ sanitizer = Sanitizer(
+ conf.getlist("allowed-elements"),
+ conf.getlist("allowed-attributes"))
+
+ self._render = lambda text: sanitize(sanitizer, parser(text))
+
+ def render(self, text):
+ return self._render(text)
diff --git a/isso/views/comments.py b/isso/views/comments.py
index 1262170..c231ead 100644
--- a/isso/views/comments.py
+++ b/isso/views/comments.py
@@ -163,7 +163,7 @@ class API(object):
value=self.isso.sign([rv["id"], sha1(rv["text"])]),
max_age=self.conf.getint('max-age'))
- rv["text"] = html.markdown(rv["text"])
+ rv["text"] = self.isso.render(rv["text"])
rv["hash"] = pbkdf2(rv['email'] or rv['remote_addr'], self.isso.salt, 1000, 6).decode("utf-8")
self.cache.set('hash', (rv['email'] or rv['remote_addr']).encode('utf-8'), rv['hash'])
@@ -189,7 +189,7 @@ class API(object):
rv.pop(key)
if request.args.get('plain', '0') == '0':
- rv['text'] = html.markdown(rv['text'])
+ rv['text'] = self.isso.render(rv['text'])
return JSON(rv, 200)
@@ -230,7 +230,7 @@ class API(object):
value=self.isso.sign([rv["id"], sha1(rv["text"])]),
max_age=self.conf.getint('max-age'))
- rv["text"] = html.markdown(rv["text"])
+ rv["text"] = self.isso.render(rv["text"])
resp = JSON(rv, 200)
resp.headers.add("Set-Cookie", cookie(str(rv["id"])))
@@ -336,7 +336,7 @@ class API(object):
if request.args.get('plain', '0') == '0':
for item in rv:
- item['text'] = html.markdown(item['text'])
+ item['text'] = self.isso.render(item['text'])
return JSON(rv, 200)
diff --git a/specs/test_html.py b/specs/test_html.py
new file mode 100644
index 0000000..f03d4c2
--- /dev/null
+++ b/specs/test_html.py
@@ -0,0 +1,60 @@
+
+try:
+ import unittest2 as unittest
+except ImportError:
+ import unittest
+
+
+from isso.core import Config
+from isso.utils import html
+
+
+class TestHTML(unittest.TestCase):
+
+ def test_markdown(self):
+ convert = html.Markdown(extensions=())
+ examples = [
+ ("*Ohai!*", "Ohai!
"),
+ ("Hi", "Hi
"),
+ ("http://example.org/", 'http://example.org/
')]
+
+ for (input, expected) in examples:
+ self.assertEqual(convert(input), expected)
+
+ def test_markdown_extensions(self):
+ convert = html.Markdown(extensions=("strikethrough", "superscript"))
+ examples = [
+ ("~~strike~~ through", "strike through
"),
+ ("sup^(script)", "supscript
")]
+
+ for (input, expected) in examples:
+ self.assertEqual(convert(input), expected)
+
+ @unittest.skipIf(html.html5lib_version == "0.95", "backport")
+ def test_sanitizer(self):
+ sanitizer = html.Sanitizer(elements=[], attributes=[])
+ examples = [
+ ('Look: 
', 'Look: '),
+ ('Ha', 'Ha'),
+ ('Ha', 'Ha'),
+ ('Test
', 'Test
'),
+ ('', 'alert("Onoe")')]
+
+ for (input, expected) in examples:
+ self.assertEqual(html.sanitize(sanitizer, input), expected)
+
+ @unittest.skipIf(html.html5lib_version == "0.95", "backport")
+ def test_sanitizer_extensions(self):
+ sanitizer = html.Sanitizer(elements=["img"], attributes=["src"])
+ examples = [
+ ('
', ''),
+ ('', '')]
+
+ for (input, expected) in examples:
+ self.assertEqual(html.sanitize(sanitizer, input), expected)
+
+ def test_render(self):
+ conf = Config.load(None).section("markup")
+ renderer = html.Markup(conf).render
+ self.assertEqual(renderer("http://example.org/ and sms:+1234567890"),
+ 'http://example.org/ and sms:+1234567890
')