@Test public void isSafeMarkdown() { assertTrue(service.isSafeMarkdown("Images and links are ok: [http: assertTrue(service.isSafeMarkdown("This is a test\n<p>Test</p>")); assertTrue(service.isSafeMarkdown("Lists should be okay too:\n\n- Item 1\n- Item 2")); assertFalse(service.isSafeMarkdown("No scripts allowed \n<script>alert('hello')</script>")); assertFalse(service.isSafeMarkdown("No bad attributes allowed either \n<img onload='dosomethingbad()'>Test</p>")); }
public boolean isSafeMarkdown(String markdown) { Node node = markdownParser.parse(markdown); String html = htmlRenderer.render(node); html = html.replaceAll(">\n<", "><"); html = StringEscapeUtils.unescapeHtml4(html).trim(); String safeHtml = sanitizePolicy.sanitize(html); safeHtml = StringEscapeUtils.unescapeHtml4(safeHtml).trim(); return safeHtml.equals(html); }
MarkdownService { public boolean isSafeMarkdown(String markdown) { Node node = markdownParser.parse(markdown); String html = htmlRenderer.render(node); html = html.replaceAll(">\n<", "><"); html = StringEscapeUtils.unescapeHtml4(html).trim(); String safeHtml = sanitizePolicy.sanitize(html); safeHtml = StringEscapeUtils.unescapeHtml4(safeHtml).trim(); return safeHtml.equals(html); } }
MarkdownService { public boolean isSafeMarkdown(String markdown) { Node node = markdownParser.parse(markdown); String html = htmlRenderer.render(node); html = html.replaceAll(">\n<", "><"); html = StringEscapeUtils.unescapeHtml4(html).trim(); String safeHtml = sanitizePolicy.sanitize(html); safeHtml = StringEscapeUtils.unescapeHtml4(safeHtml).trim(); return safeHtml.equals(html); } @Inject private  MarkdownService(PolicyFactory sanitizePolicy, Parser markdownParser, HtmlRenderer htmlRenderer); }
MarkdownService { public boolean isSafeMarkdown(String markdown) { Node node = markdownParser.parse(markdown); String html = htmlRenderer.render(node); html = html.replaceAll(">\n<", "><"); html = StringEscapeUtils.unescapeHtml4(html).trim(); String safeHtml = sanitizePolicy.sanitize(html); safeHtml = StringEscapeUtils.unescapeHtml4(safeHtml).trim(); return safeHtml.equals(html); } @Inject private  MarkdownService(PolicyFactory sanitizePolicy, Parser markdownParser, HtmlRenderer htmlRenderer); static MarkdownService withDefaults(); static MarkdownService of(PolicyFactory sanitizePolicy, Parser markdownParser, HtmlRenderer htmlRenderer); String markdownToHtml(String markdown); boolean isSafeMarkdown(String markdown); }
MarkdownService { public boolean isSafeMarkdown(String markdown) { Node node = markdownParser.parse(markdown); String html = htmlRenderer.render(node); html = html.replaceAll(">\n<", "><"); html = StringEscapeUtils.unescapeHtml4(html).trim(); String safeHtml = sanitizePolicy.sanitize(html); safeHtml = StringEscapeUtils.unescapeHtml4(safeHtml).trim(); return safeHtml.equals(html); } @Inject private  MarkdownService(PolicyFactory sanitizePolicy, Parser markdownParser, HtmlRenderer htmlRenderer); static MarkdownService withDefaults(); static MarkdownService of(PolicyFactory sanitizePolicy, Parser markdownParser, HtmlRenderer htmlRenderer); String markdownToHtml(String markdown); boolean isSafeMarkdown(String markdown);  }