Extract HTML sanitizer to its own file

1 files changed, 18 insertions, 0 deletions

diff --git a/plugins/base/sanitize_html.go b/plugins/base/sanitize_html.go
new file mode 100644
index 0000000..f48ef4a
--- /dev/null
+++ b/plugins/base/sanitize_html.go
@@ -0,0 +1,18 @@
+package koushinbase
+
+import (
+	"github.com/microcosm-cc/bluemonday"
+)
+
+func sanitizeHTML(b string) string {
+	p := bluemonday.UGCPolicy()
+
+	// TODO: be more strict
+	p.AllowElements("style")
+	p.AllowAttrs("style")
+
+	p.AddTargetBlankToFullyQualifiedLinks(true)
+	p.RequireNoFollowOnLinks(true)
+
+	return p.Sanitize(b)
+}