sanitizehtml: disallow tables

common/data/text/sanitizehtml/sanitize.go

 // Copyright 2017 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 // Package sanitizehtml implements a sanitizer of a very limited HTML.
 // See Sanitize comment.
 package sanitizehtml
 
 import (
         "bufio"
         "io"
         "net/url"
         "strings"
 
         "golang.org/x/net/html"
         "golang.org/x/net/html/atom"
 )
 
-// attrValueSanitizer sanitizes an attribute value.
-type attrValueSanitizer func(string) string
-
-func alwaysSafe(s string) string {
-        return s
-}
-
 func sanitizeURL(s string) string {
         const sanitizedPrefix = "about:invalid#sanitized&reason="
         switch u, err := url.Parse(s); {
         case err != nil:
                 return sanitizedPrefix + "malformed-url"
 
         case u.Scheme != "http" && u.Scheme != "https":
                 return sanitizedPrefix + "disallowed-scheme"
 
         case u.Host == "":
                 return sanitizedPrefix + "relative-url"
 
         default:
                 // re-serialize the URL to ensure that what we return is what we think
                 // we parsed.
                 return u.String()
         }
 }
 
-type attrMap map[string]attrValueSanitizer
-
-var (
-        anchorAttrs = attrMap{
-                "alt":  alwaysSafe,
-                "href": sanitizeURL,
-        }
-        trAttrs = attrMap{
-                "rowspan": alwaysSafe,
-                "colspan": alwaysSafe,
-        }
-        tdAttrs = attrMap{
-                "rowspan": alwaysSafe,
-                "colspan": alwaysSafe,
-        }
-)
-
 type stringWriter interface {
         WriteString(string) (int, error)
 }
 
 type sanitizer struct {
         sw  stringWriter
         err error
 }
 
 // p prints the text, unless there was an error before.
 func (s *sanitizer) p(safeMarkup string) {
         if s.err == nil {
                 _, s.err = s.sw.WriteString(safeMarkup)
         }
 }
 
-// printAttrs sanitizes and prints a whitelist of attributes in el
-func (s *sanitizer) printAttrs(el *html.Node, whitelist attrMap) {
-        for _, a := range el.Attr {
-                key := strings.ToLower(a.Key)
-                if sanitizer, ok := whitelist[key]; a.Namespace == "" && ok {
-                        s.p(" ")
-                        s.p(key)
-                        s.p("=\"")
-                        s.p(html.EscapeString(sanitizer(a.Val)))
-                        s.p("\"")
-                }
-        }
-}
-
-// printElem prints the safe element with a whitelist of attributes.
-// If allowedAttrs is nil, all attributes are omitted.
-//
-// Do not call for unsafe elements.
-func (s *sanitizer) printElem(safeElement *html.Node, allowedAttrs attrMap) {
-        tag := safeElement.DataAtom.String()
-        s.p("<")
-        s.p(tag)
-        if allowedAttrs == nil {
-                // ignore attributes
-        } else {
-                s.printAttrs(safeElement, allowedAttrs)
-        }
-        s.p(">")
-
-        s.visitChildren(safeElement)
-
-        s.p("</")
-        s.p(tag)
-        s.p(">")
+// printAttr prints a space and then an HTML attribute node.
+func (s *sanitizer) printAttr(key, value string) {
+        s.p(" ")
+        s.p(key)
+        s.p("=\"")
+        s.p(html.EscapeString(value))
+        s.p("\"")
 }
 
 func (s *sanitizer) visit(n *html.Node) {
         switch n.Type {
         case html.TextNode:
                 // print it escaped.
                 s.p(html.EscapeString(n.Data))
 
         case html.ElementNode:
                 // This switch statement defines what HTML elements we allow.
                 switch n.DataAtom {
                 case atom.Br:
                         // br is allowed and it should not be closed
                         s.p("<br>")
 
                 case atom.Script, atom.Style:
                         // ignore entirely
                         // do not visit children so we don't print inner text
 
                 case atom.A:
                         s.p(`<a rel="noopener" target="_blank"`)
-                        s.printAttrs(n, anchorAttrs)
+
+                        for _, a := range n.Attr {
+                                if a.Namespace != "" {
+                                        continue
+                                }
+                                switch strings.ToLower(a.Key) {
+                                case "href":
+                                        s.printAttr("href", sanitizeURL(a.Val))
+
+                                case "alt":
+                                        s.printAttr("alt", a.Val)
+                                }
+                        }
+
                         s.p(">")
                         s.visitChildren(n)
                         s.p("</a>")
 
-                case atom.P, atom.Ol, atom.Ul, atom.Li, atom.Table, atom.Strong, atom.Em:
+                case atom.P, atom.Ol, atom.Ul, atom.Li, atom.Strong, atom.Em:
                         // print without attributes
-                        s.printElem(n, nil)
+                        tag := n.DataAtom.String()
+                        s.p("<")
+                        s.p(tag)
+                        s.p(">")
 
-                case atom.Tr:
-                        s.printElem(n, trAttrs)
+                        s.visitChildren(n)
 
-                case atom.Td:
-                        s.printElem(n, tdAttrs)
+                        s.p("</")
+                        s.p(tag)
+                        s.p(">")
 
                 default:
                         // ignore the element, but visit children.
                         s.visitChildren(n)
                 }
 
         default:
                 // ignore the node, but visit children.
                 s.visitChildren(n)
         }
 }
 
 func (s *sanitizer) visitChildren(n *html.Node) {
         for c := n.FirstChild; c != nil; c = c.NextSibling {
                 s.visit(c)
         }
 }
 
 // Sanitize strips all HTML nodes except allowed ones.
 //
 // Unless explicitly specified, attributes are stripped.
 // Allowed elements:
 //  - p, br
 //  - strong, em
 //  - a
 //    - if href attribute is not a valid absolute HTTP(s) link, it is replaced
 //      with an innocuous one.
 //    - alt attribute is allowed
 //  - ul, ol, li
-//  - table
-//  - tr, td. Attributes rowspan/colspan are allowed.
 //
 // Elements <script> and <style> are ignored entirely.
 // For all other HTML nodes, Sanitize ignores the node, but visits its children.
 func Sanitize(w io.Writer, r io.Reader) (err error) {
         var root *html.Node
         root, err = html.Parse(r)
         if err != nil {
                 return err
         }
 
         sw, ok := w.(stringWriter)
         if !ok {
                 bw := bufio.NewWriter(w)
                 defer func() {
                         ferr := bw.Flush()
                         if err == nil {
                                 err = ferr
                         }
                 }()
                 sw = bw
         }
 
         s := sanitizer{sw: sw}
         s.visit(root)
         return s.err
 }