haskell/yesod
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sanitizing HTML input

Browse Source
This commit is contained in:
Michael Snoyman 2010-09-28 10:03:49 +02:00
parent 49a2bcea57
commit 7064e8bdcc
3 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Yesod/Form/Nic.hs
View File

@ -10,6 +10,7 @@ import Yesod.Form.Core
import Yesod.Hamlet import Yesod.Hamlet
import Yesod.Widget import Yesod.Widget
import qualified Data.ByteString.Lazy.UTF8 as U import qualified Data.ByteString.Lazy.UTF8 as U
import Text.HTML.SanitizeXSS (sanitizeXSS)
class YesodNic a where class YesodNic a where
-- | NIC Editor. -- | NIC Editor.
@ -24,7 +25,7 @@ maybeNicHtmlField = optionalFieldHelper nicHtmlFieldProfile
nicHtmlFieldProfile :: YesodNic y => FieldProfile sub y Html nicHtmlFieldProfile :: YesodNic y => FieldProfile sub y Html
nicHtmlFieldProfile = FieldProfile nicHtmlFieldProfile = FieldProfile
{ fpParse = Right . preEscapedString { fpParse = Right . preEscapedString . sanitizeXSS
, fpRender = U.toString . renderHtml , fpRender = U.toString . renderHtml
, fpWidget = \theId name val _isReq -> do , fpWidget = \theId name val _isReq -> do
addBody [$hamlet|%textarea.html#$theId$!name=$name$ $val$|] addBody [$hamlet|%textarea.html#$theId$!name=$name$ $val$|]

3
Yesod/Form/Profiles.hs
View File

@ -27,6 +27,7 @@ import qualified Data.ByteString.Lazy.UTF8 as U
import qualified Text.Email.Validate as Email import qualified Text.Email.Validate as Email
import Network.URI (parseURI) import Network.URI (parseURI)
import Database.Persist (PersistField) import Database.Persist (PersistField)
import Text.HTML.SanitizeXSS (sanitizeXSS)
import Text.Blaze.Builder.Utf8 (writeChar) import Text.Blaze.Builder.Utf8 (writeChar)
import Text.Blaze.Builder.Core (writeList, writeByteString) import Text.Blaze.Builder.Core (writeList, writeByteString)
@ -77,7 +78,7 @@ timeFieldProfile = FieldProfile
htmlFieldProfile :: FieldProfile sub y Html htmlFieldProfile :: FieldProfile sub y Html
htmlFieldProfile = FieldProfile htmlFieldProfile = FieldProfile
{ fpParse = Right . preEscapedString { fpParse = Right . preEscapedString . sanitizeXSS
, fpRender = U.toString . renderHtml , fpRender = U.toString . renderHtml
, fpWidget = \theId name val _isReq -> addBody [$hamlet| , fpWidget = \theId name val _isReq -> addBody [$hamlet|
%textarea.html#$theId$!name=$name$ $val$ %textarea.html#$theId$!name=$name$ $val$

5
yesod.cabal
View File

@ -25,7 +25,7 @@ library
, time >= 1.1.4 && < 1.3 , time >= 1.1.4 && < 1.3
, wai >= 0.2.0 && < 0.3 , wai >= 0.2.0 && < 0.3
, wai-extra >= 0.2.2 && < 0.3 , wai-extra >= 0.2.2 && < 0.3
, authenticate >= 0.6.3 && < 0.7 , authenticate >= 0.6.3.2 && < 0.7
, bytestring >= 0.9.1.4 && < 0.10 , bytestring >= 0.9.1.4 && < 0.10
, directory >= 1 && < 1.2 , directory >= 1 && < 1.2
, text >= 0.5 && < 0.10 , text >= 0.5 && < 0.10
@ -42,7 +42,7 @@ library
, cereal >= 0.2 && < 0.3 , cereal >= 0.2 && < 0.3
, dataenc >= 0.13.0.2 && < 0.14 , dataenc >= 0.13.0.2 && < 0.14
, old-locale >= 1.0.0.2 && < 1.1 , old-locale >= 1.0.0.2 && < 1.1
, persistent >= 0.2.0 && < 0.3 , persistent >= 0.2.2 && < 0.3
, neither >= 0.0.0 && < 0.1 , neither >= 0.0.0 && < 0.1
, MonadCatchIO-transformers >= 0.2.2.0 && < 0.3 , MonadCatchIO-transformers >= 0.2.2.0 && < 0.3
, data-object >= 0.3.1 && < 0.4 , data-object >= 0.3.1 && < 0.4
@ -50,6 +50,7 @@ library
, email-validate >= 0.2.5 && < 0.3 , email-validate >= 0.2.5 && < 0.3
, process >= 1.0.1 && < 1.1 , process >= 1.0.1 && < 1.1
, web-routes >= 0.23 && < 0.24 , web-routes >= 0.23 && < 0.24
, xss-sanitize >= 0.1.1 && < 0.2
exposed-modules: Yesod exposed-modules: Yesod
Yesod.Content Yesod.Content
Yesod.Dispatch Yesod.Dispatch