Skip to content
Prev Previous commit
Next Next commit
Manually whitelist tags
Signed-off-by: Lukas Reschke <[email protected]>
  • Loading branch information
LukasReschke committed Jan 13, 2017
commit ddfc7e6a3fd231f2c3fbac4a862d595cd30fd954
17 changes: 16 additions & 1 deletion settings/js/apps.js
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,22 @@ OC.Settings.Apps = OC.Settings.Apps || {
}

// Parse markdown in app description
app.description = DOMPurify.sanitize(marked(app.description.trim(), OC.Settings.Apps.markedOptions));
app.description = DOMPurify.sanitize(
marked(app.description.trim(), OC.Settings.Apps.markedOptions),
{
SAFE_FOR_JQUERY: true,
ALLOWED_TAGS: [
'strong',
'p',
'a',
'ul',
'li',
'em',
's',
'blockquote'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nickvergessen Whitelist here what you want to have whitelisted 😉

]
}
);

var html = template(app);
if (selector) {
Expand Down