From: Roger Braun <roger@rogerbraun.net>
Date: Sun, 18 Jun 2017 11:40:35 +0000 (+0200)
Subject: Strip unsafe html on output in TwAPI.
X-Git-Url: https://git.squeep.com/?a=commitdiff_plain;h=8feec8d390f34114c5f42faf366f899a2b4af9fb;p=akkoma

Strip unsafe html on output in TwAPI.
---

diff --git a/lib/pleroma/web/twitter_api/representers/activity_representer.ex b/lib/pleroma/web/twitter_api/representers/activity_representer.ex
index ade200268..6f22e45fa 100644
--- a/lib/pleroma/web/twitter_api/representers/activity_representer.ex
+++ b/lib/pleroma/web/twitter_api/representers/activity_representer.ex
@@ -105,7 +105,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.ActivityRepresenter do
       "id" => activity.id,
       "user" => UserRepresenter.to_map(user, opts),
       "attentions" => [],
-      "statusnet_html" => content,
+      "statusnet_html" => HtmlSanitizeEx.basic_html(content),
       "text" => HtmlSanitizeEx.strip_tags(content),
       "is_local" => true,
       "is_post_verb" => true,
diff --git a/test/web/twitter_api/representers/activity_representer_test.exs b/test/web/twitter_api/representers/activity_representer_test.exs
index dce6025c4..022595b91 100644
--- a/test/web/twitter_api/representers/activity_representer_test.exs
+++ b/test/web/twitter_api/representers/activity_representer_test.exs
@@ -67,7 +67,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.ActivityRepresenterTest do
       }
     }
 
-    content_html = "Some #content #mentioning <a href='#{mentioned_user.ap_id}'>@shp</shp>"
+    content_html = "<script>alert('YAY')</script>Some #content #mentioning <a href='#{mentioned_user.ap_id}'>@shp</a>"
     content = HtmlSanitizeEx.strip_tags(content_html)
     date = DateTime.from_naive!(~N[2016-05-24 13:26:08.003], "Etc/UTC") |> DateTime.to_iso8601
 
@@ -108,7 +108,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.ActivityRepresenterTest do
       "user" => UserRepresenter.to_map(user, %{for: follower}),
       "is_local" => true,
       "attentions" => [],
-      "statusnet_html" => content_html <> "<br>\n#nsfw",
+      "statusnet_html" => HtmlSanitizeEx.basic_html(content_html) <> "<br />\n#nsfw",
       "text" => content <> "\n#nsfw",
       "is_post_verb" => true,
       "created_at" => "Tue May 24 13:26:08 +0000 2016",