GRFreire/nthmail
1
0
Fork 0
mirror of https://github.com/GRFreire/nthmail.git synced 2026-01-10 05:19:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

sanitize html with bluemonday

Browse Source
This commit is contained in:
Guilherme Rugai Freire 2024-07-10 17:31:09 -03:00
parent 36f8ff684a
commit 8ef8cf75ef
No known key found for this signature in database
GPG Key ID: AC1D9B6E48E16AC1
5 changed files with 26 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
README.md
View File

@ -5,6 +5,5 @@ A temporary email service
## TODO ## TODO
- Do not store the raw mail data in the DB, maybe use block storage (the provider can be a disk provider at first) - Do not store the raw mail data in the DB, maybe use block storage (the provider can be a disk provider at first)
- Use `bluemonday` to sanitize the mail html before rendering
- Cache subject parsed from email. Then when listing the email it is not necessary to parse all mails and retrieve them. - Cache subject parsed from email. Then when listing the email it is not necessary to parse all mails and retrieve them.
- Cache in general? - Cache in general?

4
go.mod
View File

@ -10,7 +10,7 @@ require (
github.com/go-chi/chi v1.5.5 // indirect github.com/go-chi/chi v1.5.5 // indirect
github.com/gorilla/css v1.0.1 // indirect github.com/gorilla/css v1.0.1 // indirect
github.com/mattn/go-sqlite3 v1.14.22 // indirect github.com/mattn/go-sqlite3 v1.14.22 // indirect
github.com/microcosm-cc/bluemonday v1.0.26 // indirect github.com/microcosm-cc/bluemonday v1.0.27 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect
golang.org/x/net v0.22.0 // indirect golang.org/x/net v0.26.0 // indirect
) )

4
go.sum
View File

@ -16,7 +16,11 @@ github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o
github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y= github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
github.com/microcosm-cc/bluemonday v1.0.26 h1:xbqSvqzQMeEHCqMi64VAs4d8uy6Mequs3rQ0k/Khz58= github.com/microcosm-cc/bluemonday v1.0.26 h1:xbqSvqzQMeEHCqMi64VAs4d8uy6Mequs3rQ0k/Khz58=
github.com/microcosm-cc/bluemonday v1.0.26/go.mod h1:JyzOCs9gkyQyjs+6h10UEVSe02CGwkhd72Xdqh78TWs= github.com/microcosm-cc/bluemonday v1.0.26/go.mod h1:JyzOCs9gkyQyjs+6h10UEVSe02CGwkhd72Xdqh78TWs=
github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc= golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=

13
pkg/web_server/mail.templ
View File

@ -2,10 +2,11 @@ package web_server
import ( import (
"github.com/russross/blackfriday/v2" "github.com/russross/blackfriday/v2"
"github.com/microcosm-cc/bluemonday"
"github.com/GRFreire/nthmail/pkg/mail_utils" "github.com/GRFreire/nthmail/pkg/mail_utils"
) )
templ mail_body_comp(rcpt_addr string, m mail_utils.Mail_obj) { templ mail_body_comp(rcpt_addr string, m mail_utils.Mail_obj, policy *bluemonday.Policy) {
<!DOCTYPE html> <!DOCTYPE html>
<html lang="en"> <html lang="en">
<head> <head>
@ -32,16 +33,16 @@ templ mail_body_comp(rcpt_addr string, m mail_utils.Mail_obj) {
</div> </div>
</div> </div>
<main> <main>
@mime_type(m.Body[m.PreferedBodyIndex]) @mime_type(m.Body[m.PreferedBodyIndex], policy)
</main> </main>
</body> </body>
</html> </html>
} }
templ mime_type(b mail_utils.Mail_body) { templ mime_type(b mail_utils.Mail_body, policy *bluemonday.Policy) {
switch b.MimeType { switch b.MimeType {
case mail_utils.Html: case mail_utils.Html:
@body_html(b.Data) @body_html(b.Data, policy)
case mail_utils.Markdown: case mail_utils.Markdown:
@body_markdown(b.Data) @body_markdown(b.Data)
case mail_utils.PlainText: case mail_utils.PlainText:
@ -59,9 +60,9 @@ templ body_plain(s string) {
</div> </div>
} }
templ body_html(s string) { templ body_html(s string, policy *bluemonday.Policy) {
<div class="content-html"> <div class="content-html">
@templ.Raw(s) @templ.Raw(policy.Sanitize(s))
</div> </div>
} }

7
pkg/web_server/main.go
View File

@ -14,12 +14,16 @@ import (
"github.com/GRFreire/nthmail/pkg/rig" "github.com/GRFreire/nthmail/pkg/rig"
"github.com/go-chi/chi" "github.com/go-chi/chi"
_ "github.com/mattn/go-sqlite3" _ "github.com/mattn/go-sqlite3"
"github.com/microcosm-cc/bluemonday"
) )
func Start(db *sql.DB) error { func Start(db *sql.DB) error {
server := &ServerResouces{} server := &ServerResouces{}
server.db = db server.db = db
server.policy = bluemonday.UGCPolicy()
server.policy.AllowAttrs("style").Globally()
domain, exists := os.LookupEnv("MAIL_SERVER_DOMAIN") domain, exists := os.LookupEnv("MAIL_SERVER_DOMAIN")
if !exists { if !exists {
domain = "localhost" domain = "localhost"
@ -51,6 +55,7 @@ func Start(db *sql.DB) error {
type ServerResouces struct { type ServerResouces struct {
db *sql.DB db *sql.DB
policy *bluemonday.Policy
domain string domain string
} }
@ -213,6 +218,6 @@ func (sr ServerResouces) handleMail(res http.ResponseWriter, req *http.Request)
mail_obj = mail_utils.Set_format_index(mail_obj, format, f_pref) mail_obj = mail_utils.Set_format_index(mail_obj, format, f_pref)
body := mail_body_comp(rcpt_addr, mail_obj) body := mail_body_comp(rcpt_addr, mail_obj, sr.policy)
body.Render(req.Context(), res) body.Render(req.Context(), res)
} }