Sanitize rendered html with ammonia

Author: kureuil

Cargo.lock

@@ -50,6 +50,7 @@ serde = "1.0.0"
 clippy = { version = "=0.0.142", optional = true }
 chrono = "0.4.0"
 pulldown-cmark = { version = "0.0.15", default-features = false }
+ammonia = "0.5.0"
 
 conduit = "0.8"
 conduit-conditional-get = "0.8"

Cargo.toml

@@ -17,6 +17,7 @@ extern crate log;
 extern crate serde_json;
 #[macro_use]
 extern crate serde_derive;
+extern crate ammonia;
 extern crate chrono;
 extern crate curl;
 extern crate diesel_full_text_search;

src/lib.rs

@@ -1,11 +1,16 @@
+use ammonia::Ammonia;
 use pulldown_cmark::Parser;
 use pulldown_cmark::html;
 
 use util::CargoResult;
 
 pub fn markdown_to_html(text: &str) -> CargoResult<String> {
     let mut rendered = String::with_capacity(text.len() * 3 / 2);
+    let cleaner = Ammonia {
+        keep_cleaned_elements: true,
+        ..Ammonia::default()
+    };
     let parser = Parser::new(text);
     html::push_html(&mut rendered, parser);
-    Ok(rendered)
+    Ok(cleaner.clean(&rendered))
 }