Jakub Zych
5beb1c5634
The three-regex gate could be bypassed (an attribute without a space, <svg/onload>, entity-encoded or tab-split javascript: URLs, MathML xlink:href, base, meta refresh, forms) and it blanked a whole post or category when ordinary text such as "Data: 12 maja 2024" matched. - sanitizeJournalHtml runs sanitize-html with the Journal plugin's bluemonday policy: UGC elements plus footer, class, schema.org microdata, four validated inline styles, footnote roles, dir=auto, two chat transcript data attributes; http, https, mailto and relative URLs only - gateJournalHtml and isSafeJournalHtml keep their signatures; html is always the sanitized value and is never blanked - post body, category content and both page payloads are sanitized; the blocked notice, its style and string, and the blocked props and content_blocked field are removed - toPostView moves to postView.ts so list pages and cards do not load the sanitizer - tests cover every bypass from the review, the Data:/metadata: text and an imported author footer; the SSR smoke expects the unsafe sample's safe paragraphs
39 lines
902 B
JSON
39 lines
902 B
JSON
{
|
|
"journal": {
|
|
"index": {
|
|
"title": "Latest posts",
|
|
"empty": "There are no posts yet."
|
|
},
|
|
"pagination": {
|
|
"label": "Pagination",
|
|
"previous": "Previous page",
|
|
"next": "Next page",
|
|
"pageTitle": "Page {page}"
|
|
},
|
|
"post": {
|
|
"publishedOn": "Published on {date}",
|
|
"readingTime": "{minutes} min read",
|
|
"by": "By",
|
|
"related": "Related posts",
|
|
"previous": "Previous post",
|
|
"next": "Next post"
|
|
},
|
|
"category": {
|
|
"empty": "There are no posts in this category yet."
|
|
},
|
|
"tag": {
|
|
"title": "Posts tagged {name}",
|
|
"empty": "There are no posts with this tag yet."
|
|
},
|
|
"author": {
|
|
"title": "Posts by {name}",
|
|
"posts": "Posts",
|
|
"empty": "This author has not published any posts yet."
|
|
},
|
|
"readMore": "Read more",
|
|
"rss": {
|
|
"title": "RSS feed"
|
|
}
|
|
}
|
|
}
|