`RENDER_CONTENT_MODE = no-sanitizer` still sanitizes output

[jimparis]

Description

The RENDER_CONTENT_MODE setting isn't working. If I sent it to no-sanitize, it's still changing the rendered output. For example, with this config in my app.ini:

[markup.test]
ENABLED = true
FILE_EXTENSIONS = .test
RENDER_CONTENT_MODE = no-sanitizer
RENDER_COMMAND = echo <script>window.alert("hi")</script>                                                                                                                                                                              

When I visit a foo.test file, Gitea is still sanitizing the output:

	<div class="ui bottom attached table unstackable segment">
		
		<div class="file-view markup test">
			
				&lt;script&gt;window.alert(&#34;hi&#34;)&lt;/script&gt;

			
		</div>
	</div>

I expected to see:

	<div class="ui bottom attached table unstackable segment">
		
		<div class="file-view markup test">
			
				<script>window.alert("hi")</script>

			
		</div>
	</div>

Gitea Version

1.24.6

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Linux

How are you running Gitea?

Official binary

Database

SQLite

[wxiaoguang]

Also need to set NEED_POSTPROCES=false (hmm, it's not documented .....)

---

Update: there are still other blockers, will take a look

[wxiaoguang]

The fix: Fix external render #35727

By the way, after the fix, the command needs to be correctly quoted (to be a valid shell command):

RENDER_COMMAND = echo '<script>window.alert("hi")</script>'

[wxiaoguang]

How are you running Gitea?

Official binary

Now the nightly build is ready and contains the fix:

• https://dl.gitea.com/gitea/main-nightly/

Could you take a try? Feel free to report the issue if there is any

[jimparis]

Thank you! Yes, confirmed that it now works as expected with NEED_POST_PROCESS = false and RENDER_CONTENT_MODE = no-sanitizer.

This also fixes the same problem with the output when using RENDER_CONTENT_MODE = iframe (although I'm having a separate issue there where the iframe height is set to 0 by the enclosing page).

[wxiaoguang]

Well, "iframe" seems never working.

Then the complete fix: Make external iframe render work #35730