diff --git a/app/models/metadata_content.rb b/app/models/metadata_content.rb index a14e19f7..4105ffcc 100644 --- a/app/models/metadata_content.rb +++ b/app/models/metadata_content.rb @@ -14,4 +14,44 @@ class MetadataContent < MetadataTemplate def front_matter? false end + + private + + # Limpiar el HTML que recibimos + # + # TODO: En lugar de comprobar el Content Type acá, restringir los + # tipos de archivo a aceptar en ActiveStorage. + def sanitize(html_string) + html = Nokogiri::HTML.fragment(super html_string) + elements = 'img,audio,video,iframe' + + # Eliminar elementos sin src y comprobar su origen + html.css(elements).each do |element| + unless element['src'] + element.remove + next + end + + begin + uri = URI element['src'] + + # No permitimos recursos externos + element.remove unless uri.hostname.end_with? Site.domain + rescue URI::Error + element.remove + end + end + + # Eliminar figure sin contenido + html.css('figure').each do |figure| + figure.remove if figure.css(elements).empty? + end + + # Los videos y audios necesitan controles + html.css('audio,video').each do |resource| + resource['controls'] = true + end + + html.to_s.html_safe + end end