Skip to content

Commit f9207b0

Browse files
wxiaoguangwxiaoguang
authored
Refactor Safe modifier (#29392)
After this PR: no need to play with the Safe/Escape tricks anymore. See the changes for more details.
1 parent 2e33671 commit f9207b0

File tree

26 files changed

+89
-65
lines changed

26 files changed

+89
-65
lines changed

‎docs/content/administration/mail-templates.en-us.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,7 @@ the messages. Here's a list of some of them:
266266
| `AppDomain` | - | Any | Gitea's host name |
267267
| `EllipsisString` | string, int | Any | Truncates a string to the specified length; adds ellipsis as needed |
268268
| `Str2html` | string | Body only | Sanitizes text by removing any HTML tags from it. |
269-
| `Safe` | string | Body only | Takes the input as HTML; can be used for `.ReviewComments.RenderedContent`. |
269+
| `SafeHTML` | string | Body only | Takes the input as HTML; can be used for `.ReviewComments.RenderedContent`. |
270270

271271
These are _functions_, not metadata, so they have to be used:
272272

‎docs/content/administration/mail-templates.zh-cn.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -242,14 +242,14 @@ _主题_ 和 _邮件正文_ 由 [Golang的模板引擎](https://go.dev/pkg/text/
242242

243243
模板系统包含一些函数，可用于进一步处理和格式化消息。以下是其中一些函数的列表：
244244

245-
| 函数名 | 参数 | 可用于 | 用法 |
246-
| ----------------- | ----------- | ------------ | --------------------------------------------------------------------------------- |
247-
| `AppUrl` | - | 任何地方 | Gitea 的 URL |
248-
| `AppName` | - | 任何地方 | 从 `app.ini` 中设置，通常为 "Gitea" |
249-
| `AppDomain` | - | 任何地方 | Gitea 的主机名 |
250-
| `EllipsisString` | string, int | 任何地方 | 将字符串截断为指定长度；根据需要添加省略号 |
251-
| `Str2html` | string | 仅正文部分 | 通过删除其中的 HTML 标签对文本进行清理 |
252-
| `Safe` | string | 仅正文部分 | 将输入作为 HTML 处理；可用于 `.ReviewComments.RenderedContent` 等字段 |
245+
| 函数名 | 参数 | 可用于 | 用法 |
246+
|------------------| ----------- | ------------ | --------------------------------------------------------------------------------- |
247+
| `AppUrl` | - | 任何地方 | Gitea 的 URL |
248+
| `AppName` | - | 任何地方 | 从 `app.ini` 中设置，通常为 "Gitea" |
249+
| `AppDomain` | - | 任何地方 | Gitea 的主机名 |
250+
| `EllipsisString` | string, int | 任何地方 | 将字符串截断为指定长度；根据需要添加省略号 |
251+
| `Str2html` | string | 仅正文部分 | 通过删除其中的 HTML 标签对文本进行清理 |
252+
| `SafeHTML` | string | 仅正文部分 | 将输入作为 HTML 处理；可用于 `.ReviewComments.RenderedContent` 等字段 |
253253

254254
这些都是 _函数_，而不是元数据，因此必须按以下方式使用：
255255

‎modules/templates/helper.go‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"html"
1010
"html/template"
1111
"net/url"
12+
"slices"
1213
"strings"
1314
"time"
1415

@@ -34,7 +35,8 @@ func NewFuncMap() template.FuncMap {
3435
// html/template related functions
3536
"dict": dict, // it's lowercase because this name has been widely used. Our other functions should have uppercase names.
3637
"Eval": Eval,
37-
"Safe": Safe,
38+
"SafeHTML": SafeHTML,
39+
"HTMLFormat": HTMLFormat,
3840
"Escape": Escape,
3941
"QueryEscape": url.QueryEscape,
4042
"JSEscape": JSEscapeSafe,
@@ -177,8 +179,25 @@ func NewFuncMap() template.FuncMap {
177179
}
178180
}
179181

180-
// Safe render raw as HTML
181-
func Safe(s any) template.HTML {
182+
func HTMLFormat(s string, rawArgs ...any) template.HTML {
183+
args := slices.Clone(rawArgs)
184+
for i, v := range args {
185+
switch v := v.(type) {
186+
case nil, bool, int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64, float32, float64, template.HTML:
187+
// for most basic types (including template.HTML which is safe), just do nothing and use it
188+
case string:
189+
args[i] = template.HTMLEscapeString(v)
190+
case fmt.Stringer:
191+
args[i] = template.HTMLEscapeString(v.String())
192+
default:
193+
args[i] = template.HTMLEscapeString(fmt.Sprint(v))
194+
}
195+
}
196+
return template.HTML(fmt.Sprintf(s, args...))
197+
}
198+
199+
// SafeHTML render raw as HTML
200+
func SafeHTML(s any) template.HTML {
182201
switch v := s.(type) {
183202
case string:
184203
return template.HTML(v)

‎modules/templates/helper_test.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
package templates
55

66
import (
7+
"html/template"
78
"testing"
89

910
"github.com/stretchr/testify/assert"
@@ -56,3 +57,7 @@ func TestSubjectBodySeparator(t *testing.T) {
5657
func TestJSEscapeSafe(t *testing.T) {
5758
assert.EqualValues(t, `\u0026\u003C\u003E\'\"`, JSEscapeSafe(`&<>'"`))
5859
}
60+
61+
func TestHTMLFormat(t *testing.T) {
62+
assert.Equal(t, template.HTML("<a>&lt; < 1</a>"), HTMLFormat("<a>%s %s %d</a>", "<", template.HTML("<"), 1))
63+
}

‎templates/admin/packages/list.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{ctx.Locale.Tr "packages.settings.delete"}}
8989
</div>
9090
<div class="content">
91-
{{ctx.Locale.Tr "packages.settings.delete.notice" (`<span class="name"></span>`|Safe) (`<span class="dataVersion"></span>`|Safe)}}
91+
{{ctx.Locale.Tr "packages.settings.delete.notice" (`<span class="name"></span>`|SafeHTML) (`<span class="dataVersion"></span>`|SafeHTML)}}
9292
</div>
9393
{{template "base/modal_actions_confirm" .}}
9494
</div>

‎templates/admin/repo/list.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@
101101
</div>
102102
<div class="content">
103103
<p>{{ctx.Locale.Tr "repo.settings.delete_desc"}}</p>
104-
{{ctx.Locale.Tr "repo.settings.delete_notices_2" (`<span class="name"></span>`|Safe)}}<br>
104+
{{ctx.Locale.Tr "repo.settings.delete_notices_2" (`<span class="name"></span>`|SafeHTML)}}<br>
105105
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}<br>
106106
</div>
107107
{{template "base/modal_actions_confirm" .}}

‎templates/admin/stacktrace.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
{{ctx.Locale.Tr "admin.monitor.process.cancel"}}
4040
</div>
4141
<div class="content">
42-
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" (`<span class="name"></span>`|Safe)}}</p>
42+
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" (`<span class="name"></span>`|SafeHTML)}}</p>
4343
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_desc"}}</p>
4444
</div>
4545
{{template "base/modal_actions_confirm" .}}

‎templates/mail/issue/assigned.tmpl‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@
88
<title>{{.Subject}}</title>
99
</head>
1010

11-
{{$repo_url := printf "<a href='%s'>%s</a>" (Escape .Issue.Repo.HTMLURL) (Escape .Issue.Repo.FullName)}}
12-
{{$link := printf "<a href='%s'>#%d</a>" (Escape .Link) .Issue.Index}}
11+
{{$repo_url := HTMLFormat "<a href='%s'>%s</a>" .Issue.Repo.HTMLURL .Issue.Repo.FullName}}
12+
{{$link := HTMLFormat "<a href='%s'>#%d</a>" .Link .Issue.Index}}
1313
<body>
1414
<p>
1515
{{if .IsPull}}
16-
{{.locale.Tr "mail.issue_assigned.pull" .Doer.Name ($link|Safe) ($repo_url|Safe)}}
16+
{{.locale.Tr "mail.issue_assigned.pull" .Doer.Name $link $repo_url}}
1717
{{else}}
18-
{{.locale.Tr "mail.issue_assigned.issue" .Doer.Name ($link|Safe) ($repo_url|Safe)}}
18+
{{.locale.Tr "mail.issue_assigned.issue" .Doer.Name $link $repo_url}}
1919
{{end}}
2020
</p>
2121
<div class="footer">

‎templates/mail/issue/default.tmpl‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@
2222
{{if .Comment.IsForcePush}}
2323
{{$oldCommitUrl := printf "%s/commit/%s" .Comment.Issue.PullRequest.BaseRepo.HTMLURL .Comment.OldCommit}}
2424
{{$oldShortSha := ShortSha .Comment.OldCommit}}
25-
{{$oldCommitLink := printf "<a href='%[1]s'><b>%[2]s</b></a>" (Escape $oldCommitUrl) (Escape $oldShortSha)}}
25+
{{$oldCommitLink := HTMLFormat "<a href='%[1]s'><b>%[2]s</b></a>" $oldCommitUrl $oldShortSha}}
2626

2727
{{$newCommitUrl := printf "%s/commit/%s" .Comment.Issue.PullRequest.BaseRepo.HTMLURL .Comment.NewCommit}}
2828
{{$newShortSha := ShortSha .Comment.NewCommit}}
29-
{{$newCommitLink := printf "<a href='%[1]s'><b>%[2]s</b></a>" (Escape $newCommitUrl) (Escape $newShortSha)}}
29+
{{$newCommitLink := HTMLFormat "<a href='%[1]s'><b>%[2]s</b></a>" $newCommitUrl $newShortSha}}
3030

31-
{{.locale.Tr "mail.issue.action.force_push" .Doer.Name .Comment.Issue.PullRequest.HeadBranch ($oldCommitLink|Safe) ($newCommitLink|Safe)}}
31+
{{.locale.Tr "mail.issue.action.force_push" .Doer.Name .Comment.Issue.PullRequest.HeadBranch $oldCommitLink $newCommitLink}}
3232
{{else}}
3333
{{.locale.TrN (len .Comment.Commits) "mail.issue.action.push_1" "mail.issue.action.push_n" .Doer.Name .Comment.Issue.PullRequest.HeadBranch (len .Comment.Commits)}}
3434
{{end}}
@@ -65,7 +65,7 @@
6565
{{$.locale.Tr "mail.issue.in_tree_path" .TreePath}}
6666
<div class="review">
6767
<pre>{{.Patch}}</pre>
68-
<div>{{.RenderedContent | Safe}}</div>
68+
<div>{{.RenderedContent | SafeHTML}}</div>
6969
</div>
7070
{{end -}}
7171
{{if eq .ActionName "push"}}

‎templates/mail/notify/repo_transfer.tmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
<title>{{.Subject}}</title>
66
</head>
77

8-
{{$url := printf "<a href='%[1]s'>%[2]s</a>" (Escape .Link) (Escape .Repo)}}
8+
{{$url := HTMLFormat "<a href='%[1]s'>%[2]s</a>" .Link .Repo)}}
99
<body>
1010
<p>{{.Subject}}.
11-
{{.locale.Tr "mail.repo.transfer.body" ($url|Safe)}}
11+
{{.locale.Tr "mail.repo.transfer.body" $url}}
1212
</p>
1313
<p>
1414
---

0 commit comments

Comments
 (0)