From 8f8e53bb2792f75535ab783a20edbd74768acf5c Mon Sep 17 00:00:00 2001 From: Danielle McLean Date: Thu, 26 Oct 2017 14:40:29 +1100 Subject: [PATCH] Switch from django-markdown-deux to a pipeline thru markdown for rendering + bleach for sanitising --- Pipfile | 9 ++--- Pipfile.lock | 21 ++++++------ entries/templates/entries/h-entry.html | 2 +- home/templates/home/index.html | 4 +-- lemoncurry/settings/base.py | 47 -------------------------- lemoncurry/templatetags/bleach.py | 21 ++++++++++++ lemoncurry/templatetags/markdown.py | 18 ++++++++++ 7 files changed, 58 insertions(+), 64 deletions(-) create mode 100644 lemoncurry/templatetags/bleach.py create mode 100644 lemoncurry/templatetags/markdown.py diff --git a/Pipfile b/Pipfile index ea9df0e..833a709 100644 --- a/Pipfile +++ b/Pipfile @@ -7,11 +7,11 @@ name = "pypi" [packages] -django = "*" -django-compressor = "*" +Django = "*" +django_compressor = "*" gunicorn = "*" "psycopg2" = "*" -pillow = "*" +Pillow = "*" python-memcached = "*" django-favicon-plus = "*" django-meta = "*" @@ -21,8 +21,9 @@ django-otp = "*" qrcode = "*" django-otp-agents = "*" python-slugify = "*" -django-markdown-deux = "*" "mf2py" = "*" +Markdown = "*" +bleach = "*" [dev-packages] diff --git a/Pipfile.lock b/Pipfile.lock index 591247a..7d4d6b3 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -1,7 +1,7 @@ { "_meta": { "hash": { - "sha256": "ead57b340efa8b663100364efa6b9037299456bb3e37d533b6d7c4404608749c" + "sha256": "500facb148117065fc6e7d207f81bdc88a0f9b3c18e48e0f1b08542143775649" }, "host-environment-markers": { "implementation_name": "cpython", @@ -35,6 +35,13 @@ ], "version": "==4.6.0" }, + "bleach": { + "hashes": [ + "sha256:7a316eac1eef1e98b9813636ebe05878aab1a658d2708047fb00fe2bcbc49f84", + "sha256:760a9368002180fb8a0f4ea48dc6275378e6f311c39d0236d7b904fca1f5ea0d" + ], + "version": "==2.1.1" + }, "certifi": { "hashes": [ "sha256:54a07c09c586b0e4c619f02a5e94e36619da8e2b053e20f594348c0611803704", @@ -102,12 +109,6 @@ ], "version": "==0.0.7" }, - "django-markdown-deux": { - "hashes": [ - "sha256:5b4a3cd9454af5b4cec0e19151b41d98d09400ddae0688afb81dbf62a4edafff" - ], - "version": "==1.0.5" - }, "django-meta": { "hashes": [ "sha256:2a5b8d95099f69fb9736630c4fbf4fcc2972a1fcd9c708a5bb72dde22e84d8dd", @@ -189,11 +190,11 @@ ], "version": "==4.1.0" }, - "markdown2": { + "markdown": { "hashes": [ - "sha256:264731e7625402227ff6fb01f2d814882da7705432659a18a419c508e8bfccb1" + "sha256:73af797238b95768b3a9b6fe6270e250e5c09d988b8e5b223fd5efa4e06faf81" ], - "version": "==2.3.4" + "version": "==2.6.9" }, "mf2py": { "hashes": [ diff --git a/entries/templates/entries/h-entry.html b/entries/templates/entries/h-entry.html index d8224ac..bb64a46 100644 --- a/entries/templates/entries/h-entry.html +++ b/entries/templates/entries/h-entry.html @@ -1,4 +1,4 @@ -{% load humanize markdown_deux_tags %}
+{% load humanize markdown %}
{% if entry.name %}

{{ entry.name }}

{% endif %}
{{ entry.content | markdown }}
diff --git a/home/templates/home/index.html b/home/templates/home/index.html index 56909a4..54e62c0 100644 --- a/home/templates/home/index.html +++ b/home/templates/home/index.html @@ -1,5 +1,5 @@ {% extends 'lemoncurry/layout.html' %} -{% load markdown_deux_tags static %} +{% load markdown static %} {% block html_class %}h-feed{% endblock %} {% block styles %} @@ -22,7 +22,7 @@ {% endfor %} - {% if user.note %}
{{ user.note | markdown:'trusted' }}
{% endif %} + {% if user.note %}
{{ user.note | markdown }}
{% endif %}
diff --git a/lemoncurry/settings/base.py b/lemoncurry/settings/base.py index 9f07b69..4aae5e8 100644 --- a/lemoncurry/settings/base.py +++ b/lemoncurry/settings/base.py @@ -73,7 +73,6 @@ INSTALLED_APPS = [ 'django_otp', 'django_otp.plugins.otp_totp', 'favicon', - 'markdown_deux', 'meta', 'lemoncurry', @@ -208,52 +207,6 @@ AGENT_COOKIE_SECURE = True # https://django-otp-official.readthedocs.io/en/latest/overview.html OTP_TOTP_ISSUER = LEMONCURRY_SITE_NAME - -# django-markdown-deux -# https://github.com/trentm/django-markdown-deux -def copy_update(source_dict, **kwargs): - copy = source_dict.copy() - copy.update(**kwargs) - return copy - - -link_patterns = [(re.compile(pat), rep) for (pat, rep) in ( - # autolink actual URLs in text - ( - r'((([A-Za-z]{3,9}:(?:\/\/)?)' + # scheme - r'(?:[\-;:&=\+\$,\w]+@)?' + # basic auth - r'[A-Za-z0-9\.\-]+(:[0-9]+)?' + # ip address - r'|(?:www\.|[\-;:&=\+\$,\w]+@)[A-Za-z0-9\.\-]+)' + # or hostname - r'((?:\/[\+~%\/\.\w\-_]*)?\??(?:[\-\+=&;%@\.\w_]*)' + # path - r'#?(?:[\.\!\/\\\w]*))?)', # hash - r'\1' - ), -)] - - -MARKDOWN_DEUX_DEFAULT_STYLE = { - 'extras': ( - 'code-friendly', - 'cuddled-lists', - 'fenced-code-blocks', - 'footnotes', - 'header-ids', - 'spoiler', - 'tag-friendly', - ), - 'link_patterns': link_patterns, - 'safe_mode': 'escape', -} - -MARKDOWN_DEUX_STYLES = { - 'default': MARKDOWN_DEUX_DEFAULT_STYLE, - 'trusted': copy_update( - MARKDOWN_DEUX_DEFAULT_STYLE, - link_patterns=[], - safe_mode=False, - ), -} - # django-meta # https://django-meta.readthedocs.io/en/latest/settings.html META_SITE_PROTOCOL = 'https' diff --git a/lemoncurry/templatetags/bleach.py b/lemoncurry/templatetags/bleach.py new file mode 100644 index 0000000..9c0eb05 --- /dev/null +++ b/lemoncurry/templatetags/bleach.py @@ -0,0 +1,21 @@ +from django import template +from django.template.defaultfilters import stringfilter +from django.utils.safestring import mark_safe + +from bleach.sanitizer import Cleaner, ALLOWED_TAGS +from bleach.linkifier import LinkifyFilter + +tags = ['code', 'p'] +tags.extend(ALLOWED_TAGS) +attributes = { + 'a': ('href', 'title', 'class') +} + +register = template.Library() +cleaner = Cleaner(tags=tags, attributes=attributes, filters=(LinkifyFilter,)) + + +@register.filter +@stringfilter +def bleach(html): + return mark_safe(cleaner.clean(html)) diff --git a/lemoncurry/templatetags/markdown.py b/lemoncurry/templatetags/markdown.py new file mode 100644 index 0000000..9a58657 --- /dev/null +++ b/lemoncurry/templatetags/markdown.py @@ -0,0 +1,18 @@ +from django import template + +from markdown import Markdown +from .bleach import bleach + +md = Markdown(extensions=( + 'markdown.extensions.extra', + 'markdown.extensions.headerid', + 'markdown.extensions.sane_lists', + 'markdown.extensions.smarty', +)) + +register = template.Library() + + +@register.filter +def markdown(source): + return bleach(md.reset().convert(source))