From 8d6b8f98b0124f2f921ed985cd81850341ea0217 Mon Sep 17 00:00:00 2001
From: Bob Mottram <bob@freedombone.net>
Date: Tue, 25 Aug 2020 20:35:55 +0100
Subject: [PATCH] Validate content warnings

---
 posts.py | 14 +++++++++++++-
 tests.py | 15 +++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/posts.py b/posts.py
index 2cd8c9c2..8ac97168 100644
--- a/posts.py
+++ b/posts.py
@@ -47,6 +47,7 @@ from capabilities import getOcapFilename
 from capabilities import capabilitiesUpdate
 from media import attachMedia
 from media import replaceYouTube
+from content import removeHtml
 from content import removeLongWords
 from content import addHtmlTags
 from content import replaceEmojiFromTags
@@ -654,6 +655,17 @@ def appendEventFields(newPost: {},
         newPost['sensitive'] = False
 
 
+def validContentWarning(cw: str) -> str:
+    """Returns a validated content warning
+    """
+    cw = removeHtml(cw)
+    # hashtags within content warnings apparently cause a lot of trouble
+    # so remove them
+    if '#' in cw:
+        cw = cw.replace('#', '').replace('  ', ' ')
+    return cw
+
+
 def createPostBase(baseDir: str, nickname: str, domain: str, port: int,
                    toUrl: str, ccUrl: str, httpPrefix: str, content: str,
                    followersOnly: bool, saveToFile: bool, clientToServer: bool,
@@ -713,7 +725,7 @@ def createPostBase(baseDir: str, nickname: str, domain: str, port: int,
     sensitive = False
     summary = None
     if subject:
-        summary = subject
+        summary = validContentWarning(subject)
         sensitive = True
 
     toRecipients = []
diff --git a/tests.py b/tests.py
index 6109dead..a514ad8e 100644
--- a/tests.py
+++ b/tests.py
@@ -20,6 +20,7 @@ from cache import getPersonFromCache
 from threads import threadWithTrace
 from daemon import runDaemon
 from session import createSession
+from posts import validContentWarning
 from posts import deleteAllPosts
 from posts import createPublicPost
 from posts import sendPost
@@ -2041,8 +2042,22 @@ def testRemoveIdEnding():
         'https://event.somedomain.net/users/foo/statuses/34544814814'
 
 
+def testValidContentWarning():
+    print('testValidContentWarning')
+    resultStr = validContentWarning('Valid content warning')
+    assert resultStr == 'Valid content warning'
+
+    resultStr = validContentWarning('Invalid #content warning')
+    assert resultStr == 'Invalid content warning'
+
+    resultStr = \
+        validContentWarning('Invalid <a href="somesite">content warning</a>')
+    assert resultStr == 'Invalid content warning'
+
+
 def runAllTests():
     print('Running tests...')
+    testValidContentWarning()
     testRemoveIdEnding()
     testJsonPostAllowsComments()
     runHtmlReplaceQuoteMarks()