default list in server side

lib/models/config.js

@@ -2,6 +2,7 @@ module.exports = function(crowi) {
   var mongoose = require('mongoose')
     , debug = require('debug')('growi:models:config')
     , uglifycss = require('uglifycss')
+    , RecommendedXSSWhiteList = require('../util/RecommendedXSSWhiteList')
     , configSchema
     , Config
 
@@ -369,7 +370,25 @@ module.exports = function(crowi) {
       return getDefaultMarkdownConfigs[key];
     }
 
-    return config.markdown[key];
+    if (this.isXSSPrevented(config)) {
+      switch (this.XSSOption(config)) {
+        case 1: // ignore all: use default option
+          return [];
+
+        case 2: // recommended
+          return RecommendedXSSWhiteList.tags;
+
+        case 3: // custom white list
+          return config.markdown[key];
+
+        default:
+          return [];
+      }
+    }
+    else {
+      return [];
+    }
+
   };
 
   configSchema.statics.attrWhiteList = function(config) {
@@ -380,7 +399,24 @@ module.exports = function(crowi) {
       return getDefaultMarkdownConfigs[key];
     }
 
-    return config.markdown[key];
+    if (this.isXSSPrevented(config)) {
+      switch (this.XSSOption(config)) {
+        case 1: // ignore all: use default option
+          return [];
+
+        case 2: // recommended
+          return RecommendedXSSWhiteList.attrs;
+
+        case 3: // custom white list
+          return config.markdown[key];
+
+        default:
+          return [];
+      }
+    }
+    else {
+      return [];
+    }
   };
 
   /**

lib/routes/admin.js

@@ -153,12 +153,8 @@ module.exports = function(crowi, app) {
   };
 
   const stringToArray = (string) => {
-    let array = string.split(',');
-    for (let i = 0; i < array.length; i++) {
-      array[i] = array[i].trim();
-    }
-
-    return array;
+    const array = string.split(',');
+    return array.map(item => item.trim());
   };
 
   // app.get('/admin/customize' , admin.customize.index);

lib/util/RecommendedXSSWhiteList.js

@@ -0,0 +1,17 @@
+/**
+ * reference: https://meta.stackexchange.com/questions/1777/what-html-tags-are-allowed-on-stack-exchange-sites
+ * plus h4, h5, h6
+ */
+
+const tags = [
+  'a', 'b', 'blockquote', 'blockquote', 'code', 'del', 'dd', 'dl', 'dt', 'em',
+  'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'i', 'img', 'kbd', 'li', 'ol', 'p', 'pre',
+  's', 'sup', 'sub', 'strong', 'strike', 'ul', 'br', 'hr',
+];
+
+const attrs = ['src', 'width', 'height', 'alt', 'title', 'href'];
+
+module.exports = {
+  tags,
+  attrs,
+};

lib/util/swigFunctions.js

@@ -124,26 +124,6 @@ module.exports = function(crowi, app, req, locals) {
     return Config.isEnabledLinebreaksInComments(config);
   };
 
-  locals.isXSSPrevented = function() {
-    const config = crowi.getConfig();
-    return Config.isXSSPrevented(config);
-  };
-
-  locals.XSSOption = function() {
-    const config = crowi.getConfig();
-    return Config.XSSOption(config);
-  };
-
-  locals.tagWhiteList = function() {
-    const config = crowi.getConfig();
-    return Config.tagWhiteList(config);
-  };
-
-  locals.attrWhiteList = function() {
-    const config = crowi.getConfig();
-    return Config.attrWhiteList(config);
-  };
-
   locals.customCss = function() {
     return Config.customCss();
   };

lib/util/xss.js

@@ -5,19 +5,9 @@ class Xss {
 
     const config = crowi.config;
     const isXSSPrevented = config.isXSSPrevented;
-    const XSSOption = config.XSSOption;
-    let tagWhiteList = config.tagWhiteList;
-    let attrWhiteList = config.attrWhiteList;
+    const tagWhiteList = config.tagWhiteList;
+    const attrWhiteList = config.attrWhiteList;
 
-    /**
-     * reference: https://meta.stackexchange.com/questions/1777/what-html-tags-are-allowed-on-stack-exchange-sites
-     */
-    const recommendedTagWhiteList = [
-      'a', 'b', 'blockquote', 'blockquote', 'code', 'del', 'dd', 'dl', 'dt', 'em',
-      'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'i', 'img', 'kbd', 'li', 'ol', 'p', 'pre',
-      's', 'sup', 'sub', 'strong', 'strike', 'ul', 'br', 'hr'
-    ];
-    const recommendedAttrWhiteList = ['src', 'width', 'height', 'alt', 'title', 'href'];
     let whiteListContent = {};
 
     // default
@@ -30,26 +20,10 @@ class Xss {
     };
 
     if (isXSSPrevented) {
-      switch (XSSOption) {
-        case 1: // ignore all: use default option
-          break;
-
-        case 2: // recommended
-          recommendedTagWhiteList.forEach(tag => {
-            whiteListContent[tag] = recommendedAttrWhiteList;
-          });
-          option['whiteList'] = whiteListContent;
-          break;
-
-        case 3: // custom white list
-          tagWhiteList.forEach(tag => {
-            whiteListContent[tag] = attrWhiteList;
-          });
-          option['whiteList'] = whiteListContent;
-          break;
-
-        default:
-      }
+      tagWhiteList.forEach(tag => {
+        whiteListContent[tag] = attrWhiteList;
+      });
+      option['whiteList'] = whiteListContent;
     }
     else {
       option['stripIgnoreTag'] = false;