change post.content and comment.content's types from String to SafeString

src/activity_pub/inbox.rs

@@ -22,6 +22,7 @@ use models::{
     reshares::*,
     users::User
 };
+use safe_string::SafeString;
 
 #[derive(Fail, Debug)]
 enum InboxError {
@@ -41,7 +42,7 @@ pub trait Inbox {
             blog_id: 0, // TODO
             slug: String::from(""), // TODO
             title: article.object_props.name_string().unwrap(),
-            content: article.object_props.content_string().unwrap(),
+            content: SafeString::new(&article.object_props.content_string().unwrap()),
             published: true,
             license: String::from("CC-0"),
             ap_url: article.object_props.url_string()?
@@ -53,7 +54,7 @@ pub trait Inbox {
         let previous_url = note.object_props.in_reply_to.clone().unwrap().as_str().unwrap().to_string();
         let previous_comment = Comment::find_by_ap_url(conn, previous_url.clone());
         Comment::insert(conn, NewComment {
-            content: note.object_props.content_string().unwrap(),
+            content: SafeString::new(&note.object_props.content_string().unwrap()),
             spoiler_text: note.object_props.summary_string().unwrap_or(String::from("")),
             ap_url: note.object_props.id_string().ok(),
             in_response_to_id: previous_comment.clone().map(|c| c.id),

src/main.rs

@@ -30,6 +30,7 @@ extern crate serde_derive;
 #[macro_use]
 extern crate serde_json;
 extern crate url;
+extern crate ammonia;
 
 use diesel::{pg::PgConnection, r2d2::{ConnectionManager, Pool}};
 use dotenv::dotenv;

src/models/comments.rs

@@ -17,11 +17,12 @@ use models::{
     users::User
 };
 use schema::comments;
+use safe_string::SafeString;
 
 #[derive(Queryable, Identifiable, Serialize, Clone)]
 pub struct Comment {
     pub id: i32,
-    pub content: String,
+    pub content: SafeString,
     pub in_response_to_id: Option<i32>,
     pub post_id: i32,
     pub author_id: i32,
@@ -34,7 +35,7 @@ pub struct Comment {
 #[derive(Insertable)]
 #[table_name = "comments"]
 pub struct NewComment {
-    pub content: String,
+    pub content: SafeString,
     pub in_response_to_id: Option<i32>,
     pub post_id: i32,
     pub author_id: i32,

src/models/posts.rs

@@ -19,6 +19,7 @@ use models::{
     users::User
 };
 use schema::posts;
+use safe_string::SafeString;
 
 #[derive(Queryable, Identifiable, Serialize)]
 pub struct Post {
@@ -26,7 +27,7 @@ pub struct Post {
     pub blog_id: i32,
     pub slug: String,
     pub title: String,
-    pub content: String,
+    pub content: SafeString,
     pub published: bool,
     pub license: String,
     pub creation_date: NaiveDateTime,
@@ -39,7 +40,7 @@ pub struct NewPost {
     pub blog_id: i32,    
     pub slug: String,
     pub title: String,
-    pub content: String,
+    pub content: SafeString,
     pub published: bool,
     pub license: String,
     pub ap_url: String

src/routes/comments.rs

@@ -13,6 +13,7 @@ use models::{
 };
 
 use utils;
+use safe_string::SafeString;
 
 #[get("/~/<_blog>/<slug>/comment")]
 fn new(_blog: String, slug: String, user: User, conn: DbConn) -> Template {
@@ -43,7 +44,7 @@ fn create(blog: String, slug: String, query: CommentQuery, data: Form<NewComment
     let post = Post::find_by_slug(&*conn, slug.clone()).unwrap();
     let form = data.get();
     let comment = Comment::insert(&*conn, NewComment {
-        content: form.content.clone(),
+        content: SafeString::new(&form.content.clone()),
         in_response_to_id: query.responding_to,
         post_id: post.id,
         author_id: user.id,

src/routes/posts.rs

@@ -15,6 +15,7 @@ use models::{
     users::User
 };
 use utils;
+use safe_string::SafeString;
 
 #[get("/~/<blog>/<slug>", rank = 4)]
 fn details(blog: String, slug: String, conn: DbConn, user: Option<User>) -> Template {
@@ -100,7 +101,7 @@ fn create(blog_name: String, data: Form<NewPostForm>, user: User, conn: DbConn)
         blog_id: blog.id,
         slug: slug.to_string(),
         title: form.title.to_string(),
-        content: content,
+        content: SafeString::new(&content),
         published: true,
         license: form.license.to_string(),
         ap_url: "".to_string()