KB66 Sanitize HTML in posts.
Change-Id: I4987c74e90befb226f1bf1f06129a665f32544bf
diff --git a/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java b/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
index 68f7a18..cd75afe 100644
--- a/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
+++ b/src/main/java/eu/mulk/mulkcms2/common/markdown/MarkdownConverter.java
@@ -11,6 +11,8 @@
import com.vladsch.flexmark.util.data.MutableDataSet;
import java.util.Arrays;
import javax.enterprise.context.ApplicationScoped;
+import org.jsoup.Jsoup;
+import org.jsoup.safety.Whitelist;
@ApplicationScoped
public class MarkdownConverter {
@@ -41,6 +43,7 @@
public String htmlify(String markdown) {
var parsedDocument = parser.parse(markdown);
- return renderer.render(parsedDocument);
+ var unsanitizedHtml = renderer.render(parsedDocument);
+ return Jsoup.clean(unsanitizedHtml, Whitelist.relaxed());
}
}