diff --git a/core/server/apps/amp/lib/helpers/amp_content.js b/core/server/apps/amp/lib/helpers/amp_content.js index 1c0a057311..4b5f84b540 100644 --- a/core/server/apps/amp/lib/helpers/amp_content.js +++ b/core/server/apps/amp/lib/helpers/amp_content.js @@ -13,6 +13,7 @@ var hbs = require('express-hbs'), sanitizeHtml = require('sanitize-html'), config = require('../../../../config'), makeAbsoluteUrl = require('../../../../utils/make-absolute-urls'), + cheerio = require('cheerio'), amperize = new Amperize(), amperizeCache = {}, allowedAMPTags = [], @@ -67,9 +68,31 @@ function ampContent() { }; return Promise.props(amperizeHTML).then(function (result) { + var $; + + // our Amperized HTML ampHTML = result.amperize || ''; - // let's sanitize our HTML!!! + // Use cheerio to traverse through HTML and make little clean-ups + $ = cheerio.load(ampHTML); + + // We have to remove source children in video, as source + // is whitelisted for audio, but causes validation + // errors in video, because video will be stripped out. + // @TODO: remove this, when Amperize support video transform + $('video').children('source').remove(); + + // Vimeo iframe e. g. come with prohibited attributes + // @TODO: remove this, when Amperize supports HTML sanitizing + $('amp-iframe').removeAttr('webkitallowfullscreen'); + $('amp-iframe').removeAttr('mozallowfullscreen'); + + // No inline style allowed + $('*').removeAttr('style'); + + ampHTML = $.html(); + + // @TODO: remove this, when Amperize supports HTML sanitizing cleanHTML = sanitizeHtml(ampHTML, { allowedTags: allowedAMPTags, allowedAttributes: false, diff --git a/core/server/apps/amp/tests/amp_content_spec.js b/core/server/apps/amp/tests/amp_content_spec.js index 957593c3a3..622ec0ff1a 100644 --- a/core/server/apps/amp/tests/amp_content_spec.js +++ b/core/server/apps/amp/tests/amp_content_spec.js @@ -136,12 +136,66 @@ describe('{{amp_content}} helper', function () { it('can transform audio tags to amp-audio', function (done) { var testData = { html: '' + - '', + '', updated_at: 'Wed Jul 27 2016 18:17:22 GMT+0200 (CEST)', id: 1 }, expectedResult = 'Your browser does not support the audio element.' + - '', + '', + ampResult = ampContentHelper.call(testData); + + ampResult.then(function (rendered) { + should.exist(rendered); + rendered.string.should.equal(expectedResult); + done(); + }).catch(done); + }); + + it('removes video tags including source children', function (done) { + var testData = { + html: '', + updated_at: 'Wed Jul 27 2016 18:17:22 GMT+0200 (CEST)', + id: 1 + }, + expectedResult = 'Your browser doesn\'t support HTML5 video tag.', + ampResult = ampContentHelper.call(testData); + + ampResult.then(function (rendered) { + should.exist(rendered); + rendered.string.should.equal(expectedResult); + done(); + }).catch(done); + }); + + it('removes inline style', function (done) { + var testData = { + html: '', + updated_at: 'Wed Jul 27 2016 18:17:22 GMT+0200 (CEST)', + id: 1 + }, + expectedResult = '', + ampResult = ampContentHelper.call(testData); + + ampResult.then(function (rendered) { + should.exist(rendered); + rendered.string.should.equal(expectedResult); + done(); + }).catch(done); + }); + + it('removes prohibited iframe attributes', function (done) { + var testData = { + html: '', + updated_at: 'Wed Jul 27 2016 18:17:22 GMT+0200 (CEST)', + id: 1 + }, + expectedResult = '', ampResult = ampContentHelper.call(testData); ampResult.then(function (rendered) {