diff --git a/app/lib/formatter.rb b/app/lib/formatter.rb index b7a0286d2d..051f274082 100644 --- a/app/lib/formatter.rb +++ b/app/lib/formatter.rb @@ -59,7 +59,7 @@ class Formatter html = "RT @#{prepend_reblog} #{html}" if prepend_reblog html = format_markdown(html) if status.content_type == 'text/markdown' html = encode_and_link_urls(html, linkable_accounts, keep_html: %w(text/markdown text/html).include?(status.content_type)) - html = reformat(html) if %w(text/markdown text/html).include?(status.content_type) + html = reformat(html, true) if %w(text/markdown text/html).include?(status.content_type) html = encode_custom_emojis(html, status.emojis, options[:autoplay]) if options[:custom_emojify] unless %w(text/markdown text/html).include?(status.content_type) @@ -75,8 +75,8 @@ class Formatter html.delete("\r").delete("\n") end - def reformat(html) - sanitize(html, Sanitize::Config::MASTODON_STRICT) + def reformat(html, outgoing = false) + sanitize(html, Sanitize::Config::MASTODON_STRICT.merge(outgoing: outgoing)) rescue ArgumentError '' end diff --git a/app/lib/sanitize_config.rb b/app/lib/sanitize_config.rb index 8bbcca4ce5..34793ed93b 100644 --- a/app/lib/sanitize_config.rb +++ b/app/lib/sanitize_config.rb @@ -60,7 +60,10 @@ class Sanitize node = env[:node] rel = (node['rel'] || '').split(' ') & ['tag'] - node['rel'] = (['nofollow', 'noopener', 'noreferrer'] + rel).join(' ') + unless env[:config][:outgoing] && TagManager.instance.local_url?(node['href']) + rel += ['nofollow', 'noopener', 'noreferrer'] + end + node['rel'] = rel.join(' ') end UNSUPPORTED_HREF_TRANSFORMER = lambda do |env| @@ -103,8 +106,8 @@ class Sanitize transformers: [ CLASS_WHITELIST_TRANSFORMER, IMG_TAG_TRANSFORMER, - LINK_REL_TRANSFORMER, UNSUPPORTED_HREF_TRANSFORMER, + LINK_REL_TRANSFORMER, ] ) diff --git a/spec/lib/sanitize_config_spec.rb b/spec/lib/sanitize_config_spec.rb index 2d82c00eaf..7370c536b6 100644 --- a/spec/lib/sanitize_config_spec.rb +++ b/spec/lib/sanitize_config_spec.rb @@ -7,6 +7,12 @@ describe Sanitize::Config do describe '::MASTODON_STRICT' do subject { Sanitize::Config::MASTODON_STRICT } + around do |example| + original_web_domain = Rails.configuration.x.web_domain + example.run + Rails.configuration.x.web_domain = original_web_domain + end + it 'keeps h1' do expect(Sanitize.fragment('