Add a function for sanitizing HTML

README.md

@@ -402,6 +402,9 @@ unixnano() -> number
 // Convert Markdown to HTML
 markdown(string) -> string
 
+// Sanitize HTML
+sanhtml(string) -> string
+
 // Return the directory where the REPL or script is running. If a filename (optional) is given, then the path to where the script is running, joined with a path separator and the given filename, is returned.
 scriptdir([string]) -> string
 

engine/basic.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/gomarkdown/markdown"
 	"github.com/gomarkdown/markdown/parser"
+	"github.com/microcosm-cc/bluemonday"
 	log "github.com/sirupsen/logrus"
 	"github.com/xyproto/algernon/lua/convert"
 	"github.com/xyproto/algernon/utils"
@@ -102,6 +103,18 @@ func (ac *Config) LoadBasicSystemFunctions(L *lua.LState) {
 		return 1 // number of results
 	}))
 
+	// Sanitize HTML
+	L.SetGlobal("sanhtml", L.NewFunction(func(L *lua.LState) int {
+		// Retrieve the HTML content to be sanitized
+		htmlContent := L.ToString(1)
+		// Sanitize the HTML content
+		policy := bluemonday.UGCPolicy()
+		sanitizedHTML := policy.Sanitize(htmlContent)
+		// Return the sanitized HTML
+		L.Push(lua.LString(sanitizedHTML))
+		return 1 // number of results
+	}))
+
 	// Get the full filename of a given file that is in the directory
 	// where the server is running (root directory for the server).
 	// If no filename is given, the directory where the server is

engine/help.go

@@ -288,6 +288,8 @@ sleep(number)
 unixnano() -> number
 // Convert Markdown to HTML
 markdown(string) -> string
+// Sanitize HTML
+sanhtml(string) -> string
 // Query a PostgreSQL database with a query and a connection string.
 // Default connection string: "host=localhost port=5432 user=postgres dbname=test sslmode=disable"
 PQ([string], [string]) -> table