ReplyBody
Corex\Config\Submissions\ReplyBody · class · Config layer
Reduces what was posted as a reply to the formatting a reply has (spec 106, FR-004). A reply has paragraphs, line breaks, emphasis, lists and links. Everything else that arrives, from a paste, from another client of the route or from somebody trying, is removed here, on the server, before the reply is stored, previewed or sent. Its words are kept: the person sees what remains. Colours, fonts and images belong to the email’s template, so that every reply from a site looks like that site. The order matters, and each step is here because a test met what happens without it: 1. Comments, scripts and style sheets go with what is inside them. The allowlist alone leaves a script’s source standing in the message as text, and lets a comment through whole: one unclosed <!-- hid the rest of a reply from the person it was sent to. 2. A < that does not begin a tag is text: “Sam sam@example.com” and “<500 EGP” are what people type in a reply, and the allowlist deleted them as if they were markup. 3. A block a reply does not have (a div, a heading, a table’s cell) ends a paragraph where it begins and ends, and a line end inside markup is read as a space. Before the allowlist, which takes those tags and would leave their lines run together. 4. The allowlist. 5. Every link is read again from what the allowlist wrote, and kept only if it goes to the web, a mailbox or a telephone. Read afterwards, not before: WordPress’s two readers of markup disagree about what is a tag inside <xmp> or <textarea>, and the allowlist answers a refused scheme by deleting the scheme and keeping the rest as the address, so javascript:alert(1) was left as a link to alert(1). 6. Paragraphs are made of what is left, no tag is left open, and nothing is left empty.
Public API
Section titled “Public API”isTooLong(mixed $posted): bool
Section titled “isTooLong(mixed $posted): bool”Whether what was posted is beyond what is read as a reply. Such a message is reduced to nothing, which a route that keeps what it is given must not take for an emptied box.