appview/pages: rework sanitizer

- initialize sanitizer once, and reuse for life
- improve policies, and allow sanitizer to hold multiple policies
(this will come in handy, for PR titles, repo description, profiles
description etc.)
- add general safe items to allow list, most of these are generated by
goldmark GFM

Signed-off-by: oppiliappan <[e-mail]>

appview/pages/markup/markdown.go

···
 	"io"
 	"net/url"
 	"path"
+	"regexp"
 	"strings"
 
 	"github.com/microcosm-cc/bluemonday"
···
 	repoinfo.RepoInfo
 	IsDev        bool
 	RendererType RendererType
+	Sanitizer    Sanitizer
+}
+
+type Sanitizer struct {
+	defaultPolicy *bluemonday.Policy
 }
 
 func (rctx *RenderContext) RenderMarkdown(source string) string {
···
 	}
 }
 
-func (rctx *RenderContext) Sanitize(html string) string {
+func (rctx *RenderContext) SanitizeDefault(html string) string {
+	return rctx.Sanitizer.defaultPolicy.Sanitize(html)
+}
+
+func NewSanitizer() Sanitizer {
+	return Sanitizer{
+		defaultPolicy: defaultPolicy(),
+	}
+}
+func defaultPolicy() *bluemonday.Policy {
 	policy := bluemonday.UGCPolicy()
 
+	// Allow generally safe attributes
+	generalSafeAttrs := []string{
+		"abbr", "accept", "accept-charset",
+		"accesskey", "action", "align", "alt",
+		"aria-describedby", "aria-hidden", "aria-label", "aria-labelledby",
+		"axis", "border", "cellpadding", "cellspacing", "char",
+		"charoff", "charset", "checked",
+		"clear", "cols", "colspan", "color",
+		"compact", "coords", "datetime", "dir",
+		"disabled", "enctype", "for", "frame",
+		"headers", "height", "hreflang",
+		"hspace", "ismap", "label", "lang",
+		"maxlength", "media", "method",
+		"multiple", "name", "nohref", "noshade",
+		"nowrap", "open", "prompt", "readonly", "rel", "rev",
+		"rows", "rowspan", "rules", "scope",
+		"selected", "shape", "size", "span",
+		"start", "summary", "tabindex", "target",
+		"title", "type", "usemap", "valign", "value",
+		"vspace", "width", "itemprop",
+	}
+
+	generalSafeElements := []string{
+		"h1", "h2", "h3", "h4", "h5", "h6", "h7", "h8", "br", "b", "i", "strong", "em", "a", "pre", "code", "img", "tt",
+		"div", "ins", "del", "sup", "sub", "p", "ol", "ul", "table", "thead", "tbody", "tfoot", "blockquote", "label",
+		"dl", "dt", "dd", "kbd", "q", "samp", "var", "hr", "ruby", "rt", "rp", "li", "tr", "td", "th", "s", "strike", "summary",
+		"details", "caption", "figure", "figcaption",
+		"abbr", "bdo", "cite", "dfn", "mark", "small", "span", "time", "video", "wbr",
+	}
+
+	policy.AllowAttrs(generalSafeAttrs...).OnElements(generalSafeElements...)
+
 	// video
-	policy.AllowElements("video")
-	policy.AllowAttrs("controls").OnElements("video")
-	policy.AllowElements("source")
-	policy.AllowAttrs("src", "type").OnElements("source")
+	policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")
+
+	// checkboxes
+	policy.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
+	policy.AllowAttrs("checked", "disabled", "data-source-position").OnElements("input")
 
 	// centering content
 	policy.AllowElements("center")
···
 		"margin-top",
 		"margin-bottom",
 	)
-	return policy.Sanitize(html)
+
+	return policy
 }
 
 type MarkdownTransformer struct {

appview/pages/pages.go

···
 		IsDev:      config.Core.Dev,
 		CamoUrl:    config.Camo.Host,
 		CamoSecret: config.Camo.SharedSecret,
+		Sanitizer:  markup.NewSanitizer(),
 	}
 
 	p := &Pages{
···
 	p.rctx.RendererType = markup.RendererTypeRepoMarkdown
 
 	if params.ReadmeFileName != "" {
-		var htmlString string
 		ext := filepath.Ext(params.ReadmeFileName)
 		switch ext {
 		case ".md", ".markdown", ".mdown", ".mkdn", ".mkd":
-			htmlString = p.rctx.Sanitize(htmlString)
-			htmlString = p.rctx.RenderMarkdown(params.Readme)
 			params.Raw = false
-			params.HTMLReadme = template.HTML(htmlString)
+			htmlString := p.rctx.RenderMarkdown(params.Readme)
+			sanitized := p.rctx.SanitizeDefault(htmlString)
+			params.HTMLReadme = template.HTML(sanitized)
 		default:
 			params.Raw = true
 		}
···
 			p.rctx.RepoInfo = params.RepoInfo
 			p.rctx.RendererType = markup.RendererTypeRepoMarkdown
 			htmlString := p.rctx.RenderMarkdown(params.Contents)
-			params.RenderedContents = template.HTML(p.rctx.Sanitize(htmlString))
+			sanitized := p.rctx.SanitizeDefault(htmlString)
+			params.RenderedContents = template.HTML(sanitized)
 		}
 	}
 
···
 	if params.ShowRendered {
 		switch markup.GetFormat(params.String.Filename) {
 		case markup.FormatMarkdown:
-			p.rctx.RendererType = markup.RendererTypeDefault
+			p.rctx.RendererType = markup.RendererTypeRepoMarkdown
 			htmlString := p.rctx.RenderMarkdown(params.String.Contents)
-			params.RenderedContents = template.HTML(p.rctx.Sanitize(htmlString))
+			sanitized := p.rctx.SanitizeDefault(htmlString)
+			params.RenderedContents = template.HTML(sanitized)
 		}
 	}