Repository description not escaped

[yasuokav]

• Gitea version (or commit ref): e3875ac
• Git version: 2.17.1
• Operating system: Ubuntu
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL): https://try.gitea.io/cezar97/Gitea_Issue_Escaping
  • No
  • Not relevant
• Log gist:

Description

Related: #3903

Screenshots

[6543]

-> https://github.com/go-gitea/gitea/blob/master/templates/repo/home.tmpl#L8

[zeripath]

gitea/models/repo.go

Lines 831 to 839 in e3875ac

	// DescriptionHTML does special handles to description and return HTML string.
	func (repo *Repository) DescriptionHTML() template.HTML {
	desc, err := markup.RenderDescriptionHTML([]byte(repo.Description), repo.HTMLURL(), repo.ComposeMetas())
	if err != nil {
	log.Error("Failed to render description for %s (ID: %d): %v", repo.Name, repo.ID, err)
	return template.HTML(markup.Sanitize(repo.Description))
	}
	return template.HTML(markup.Sanitize(string(desc)))
	}

The HTML is sanitised preventing any security issue. It is escaped.

[6543]

done at #6306