diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2024-12-08 16:29:29 +0100 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2024-12-08 16:29:29 +0100 |
| commit | 5ba5271e48e1527f9188e38c0a113f6431d36ebd (patch) | |
| tree | 70866dc8d2193608c41071556862ecfd13eeea44 /app/Models | |
| parent | fb0f89c3fede088869629ccaf1bec788ce1c07cb (diff) | |
Sanitize before CSS manipulation (#7073)
Allows using the same CSS filters for content coming from RSS feeds and from Web scraping
fix https://github.com/FreshRSS/FreshRSS/issues/7039
https://github.com/FreshRSS/FreshRSS/issues/7014#issuecomment-2508987606
https://github.com/FreshRSS/FreshRSS/pull/7037
Diffstat (limited to 'app/Models')
| -rw-r--r-- | app/Models/Entry.php | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/app/Models/Entry.php b/app/Models/Entry.php index 7c0d02ddb..9854da131 100644 --- a/app/Models/Entry.php +++ b/app/Models/Entry.php @@ -844,7 +844,13 @@ HTML; $base = (parse_url($url, PHP_URL_SCHEME) ?? 'https') . ':' . $base; } - $content = ''; + unset($xpath, $doc); + $html = sanitizeHTML($html, $base); + $doc = new DOMDocument(); + $doc->loadHTML($html, LIBXML_NONET | LIBXML_NOERROR | LIBXML_NOWARNING); + $xpath = new DOMXPath($doc); + + $html = ''; $cssSelector = htmlspecialchars_decode($feed->pathEntries(), ENT_QUOTES); $cssSelector = trim($cssSelector, ', '); $nodes = $xpath->query((new Gt\CssXPath\Translator($cssSelector, '//'))->asXPath()); @@ -864,11 +870,10 @@ HTML; $filterednode->parentNode->removeChild($filterednode); } } - $content .= $doc->saveHTML($node) . "\n"; + $html .= $doc->saveHTML($node) . "\n"; } } - $html = trim(sanitizeHTML($content, $base)); - return $html; + return trim($html); } else { throw new Minz_Exception(); } |