Allow to bypass sanitizer for external rendering #3664

New Issue

GiteaMirror · 2025-11-02T05:21:03-06:00

GiteaMirror commented

2025-11-02 05:21:03 -06:00

Originally created by @sapk on GitHub (Jul 24, 2019).

Before doing a PR that may impact security I would like to have your advice

I would need to bypass the sanitizer by adding an option to external markup like DISABLE_SANITIZER.

The goal is for issue like https://github.com/go-gitea/gitea/issues/5979 to be able to load JS libs (external or in public) like https://git.sapk.fr/Madeleine.js/examples/ajax.html

I think this would largely improve external rendering without introducing security risk by default but let the admin the possibility to load js or html that it trust.

Originally created by @sapk on GitHub (Jul 24, 2019). Before doing a PR that may impact security I would like to have your advice I would need to bypass the [sanitizer](https://github.com/go-gitea/gitea/blob/8ad64574ee80692ccc39c797ff88f65f09449412/modules/markup/markup.go#L87) by adding an option to external [markup](https://docs.gitea.io/en-us/config-cheat-sheet/#markup-markup) like DISABLE_SANITIZER. The goal is for issue like https://github.com/go-gitea/gitea/issues/5979 to be able to load JS libs (external or in public) like https://git.sapk.fr/Madeleine.js/examples/ajax.html I think this would largely improve external rendering without introducing security risk by default but let the admin the possibility to load js or html that it trust.

GiteaMirror added the type/proposal label 2025-11-02 05:21:03 -06:00

GiteaMirror closed this issue

2025-11-02 05:21:03 -06:00

GiteaMirror commented

2025-11-02 05:21:04 -06:00

@wxiaoguang commented on GitHub (Jul 5, 2022):

Here it is: RENDER_CONTENT_MODE

@wxiaoguang commented on GitHub (Jul 5, 2022): Here it is: RENDER_CONTENT_MODE

GiteaMirror referenced this issue

2025-11-02 12:24:47 -06:00

[PR #3664] [MERGED] Global code search support #17036

Sign in to join this conversation.