normalise markup by default (#316)

why was this _not_ default?

honestly i'm surprised pleroma hasn't exploded yet

Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/316

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a5402da125871fcb1ddfdccb7fd82dad5b35ad1..4b7b7e836b579257ccc494cf49434e242b23f0df 100644 (file)
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ## Changed
 - MastoAPI: Accept BooleanLike input on `/api/v1/accounts/:id/follow` (fixes follows with mastodon.py)
 - Relays from akkoma are now off by default
+- NormalizeMarkup MRF is now on by default
 
 ## 2022.11
 

diff --git a/docs/docs/configuration/cheatsheet.md b/docs/docs/configuration/cheatsheet.md
index 94c32f2a83e9f498a0a7861bf36a70d7c705f82f..517fd1993282d81fb169644d3a5cc7753684fbe0 100644 (file)
--- a/docs/docs/configuration/cheatsheet.md
+++ b/docs/docs/configuration/cheatsheet.md
@@ -120,6 +120,8 @@ To add configuration to your config file, you can copy it from the base config.
     * `Pleroma.Web.ActivityPub.MRF.FollowBotPolicy`: Automatically follows newly discovered users from the specified bot account. Local accounts, locked accounts, and users with "#nobot" in their bio are respected and excluded from being followed.
     * `Pleroma.Web.ActivityPub.MRF.AntiFollowbotPolicy`: Drops follow requests from followbots. Users can still allow bots to follow them by first following the bot.
     * `Pleroma.Web.ActivityPub.MRF.KeywordPolicy`: Rejects or removes from the federated timeline or replaces keywords. (See [`:mrf_keyword`](#mrf_keyword)).
+    * `Pleroma.Web.ActivityPub.MRF.NormalizeMarkup`: Pass inbound HTML through a scrubber to make sure it doesn't have anything unusual in it. On by default, cannot be turned off.
+    * `Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy`: Append a link to a post that quotes another post with the link to the quoted post, to ensure that software that does not understand quotes can have full context. On by default, cannot be turned off.
 * `transparency`: Make the content of your Message Rewrite Facility settings public (via nodeinfo).
 * `transparency_exclusions`: Exclude specific instance names from MRF transparency.  The use of the exclusions feature will be disclosed in nodeinfo as a boolean value.
 * `transparency_obfuscate_domains`: Show domains with `*` in the middle, to censor them if needed. For example, `ridingho.me` will show as `rid*****.me`

diff --git a/lib/pleroma/web/activity_pub/mrf.ex b/lib/pleroma/web/activity_pub/mrf.ex
index 0d4986e681ba5a27f2cbd942042e3ae61b1221ca..064ffc527adef1b085a334255ad3897b32b8f2e5 100644 (file)
--- a/lib/pleroma/web/activity_pub/mrf.ex
+++ b/lib/pleroma/web/activity_pub/mrf.ex
@@ -140,7 +140,8 @@ defmodule Pleroma.Web.ActivityPub.MRF do
     |> get_policies()
     |> Enum.concat([
       Pleroma.Web.ActivityPub.MRF.HashtagPolicy,
-      Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy
+      Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy,
+      Pleroma.Web.ActivityPub.MRF.NormalizeMarkup
     ])
     |> Enum.uniq()
   end

diff --git a/test/pleroma/web/activity_pub/mrf/normalize_markup_test.exs b/test/pleroma/web/activity_pub/mrf/normalize_markup_test.exs
index 52a23fdca4723d50a674edbf132046cf2d317014..133485a868e74757ed6ff0967f57e34aeb82d20d 100644 (file)
--- a/test/pleroma/web/activity_pub/mrf/normalize_markup_test.exs
+++ b/test/pleroma/web/activity_pub/mrf/normalize_markup_test.exs
@@ -15,6 +15,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.NormalizeMarkupTest do
   this is a link with not allowed "rel" attribute: <a href="http://example.com/" rel="tag noallowed">example.com</a>
   this is an image: <img src="http://example.com/image.jpg"><br />
   <script>alert('hacked')</script>
+  <div class="wow no classes here">mean</div>
   """
 
   @expected """
@@ -25,6 +26,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.NormalizeMarkupTest do
   this is a link with not allowed &quot;rel&quot; attribute: <a href="http://example.com/">example.com</a>
   this is an image: <img src="http://example.com/image.jpg"/><br/>
   alert(&#39;hacked&#39;)
+  mean
   """
 
   test "it filter html tags" do

diff --git a/test/pleroma/web/activity_pub/mrf_test.exs b/test/pleroma/web/activity_pub/mrf_test.exs
index f04c69afb693299d41bdaafd35e314d0ac4c1f98..86ad0ab6b2ed4224e724ae1caa984895b45df2f0 100644 (file)
--- a/test/pleroma/web/activity_pub/mrf_test.exs
+++ b/test/pleroma/web/activity_pub/mrf_test.exs
@@ -77,7 +77,7 @@ defmodule Pleroma.Web.ActivityPub.MRFTest do
       clear_config([:mrf, :policies], [Pleroma.Web.ActivityPub.MRF.NoOpPolicy])
 
       expected = %{
-        mrf_policies: ["NoOpPolicy", "HashtagPolicy", "InlineQuotePolicy"],
+        mrf_policies: ["NoOpPolicy", "HashtagPolicy", "InlineQuotePolicy", "NormalizeMarkup"],
         mrf_hashtag: %{
           federated_timeline_removal: [],
           reject: [],
@@ -93,7 +93,7 @@ defmodule Pleroma.Web.ActivityPub.MRFTest do
       clear_config([:mrf, :policies], [MRFModuleMock])
 
       expected = %{
-        mrf_policies: ["MRFModuleMock", "HashtagPolicy", "InlineQuotePolicy"],
+        mrf_policies: ["MRFModuleMock", "HashtagPolicy", "InlineQuotePolicy", "NormalizeMarkup"],
         mrf_module_mock: "some config data",
         mrf_hashtag: %{
           federated_timeline_removal: [],