Archives/Athou_commafeed
1
0
Fork 1
mirror of https://github.com/Athou/commafeed.git synced 2026-03-21 21:37:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

bypass angular sanitization, doing it with jsoup and allowing embedded videos

Browse Source 
add html content to dom only when entry is opened
This commit is contained in:
Jeremie Panzer
2013-03-27 16:42:05 +01:00
parent 3b33d7588b
commit 054be51c9c
6 changed files with 37 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/main/java/com/commafeed/backend/feeds/FeedParser.java
View File

@@ -9,6 +9,7 @@ import javax.ejb.Stateless;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.lang.SystemUtils;
import org.jsoup.Jsoup;
import org.jsoup.safety.Whitelist;
import com.commafeed.backend.model.Feed;
import com.commafeed.backend.model.FeedEntry;
@@ -71,8 +72,14 @@ public class FeedParser {
}
private String handleContent(String content) {
org.jsoup.nodes.Document doc = Jsoup.parse(content, "UTF-8");
doc.select("a").attr("target", "_blank");
return doc.outerHtml();
Whitelist whitelist = Whitelist.relaxed();
whitelist.addEnforcedAttribute("a", "target", "_blank");
// TODO evaluate potential security issues
whitelist.addTags("iframe");
whitelist.addAttributes("iframe", "src", "height", "width",
"allowfullscreen", "frameborder");
return Jsoup.clean(content, whitelist);
}
}