From 8bca89a433c414c6466fea5faa9889be681b184a Mon Sep 17 00:00:00 2001
From: KN4CK3R <admin@oldschoolhack.me>
Date: Mon, 7 Jun 2021 18:55:26 +0200
Subject: [PATCH 1/2] Fix data URI scramble (#16098)

* Removed unused method.

* No prefix for data uris.

* Added test to prevent regressions.
---
 modules/markup/html.go      | 11 +++--------
 modules/markup/html_test.go | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/modules/markup/html.go b/modules/markup/html.go
index bec9ba2fb49f6..908b4de09fa39 100644
--- a/modules/markup/html.go
+++ b/modules/markup/html.go
@@ -403,24 +403,19 @@ func (ctx *postProcessCtx) visitNode(node *html.Node, visitText bool) {
 		}
 	case html.ElementNode:
 		if node.Data == "img" {
-			attrs := node.Attr
-			for idx, attr := range attrs {
+			for _, attr := range node.Attr {
 				if attr.Key != "src" {
 					continue
 				}
-				link := []byte(attr.Val)
-				if len(link) > 0 && !IsLink(link) {
+				if len(attr.Val) > 0 && !isLinkStr(attr.Val) && !strings.HasPrefix(attr.Val, "data:image/") {
 					prefix := ctx.urlPrefix
 					if ctx.isWikiMarkdown {
 						prefix = util.URLJoin(prefix, "wiki", "raw")
 					}
 					prefix = strings.Replace(prefix, "/src/", "/media/", 1)
 
-					lnk := string(link)
-					lnk = util.URLJoin(prefix, lnk)
-					link = []byte(lnk)
+					attr.Val = util.URLJoin(prefix, attr.Val)
 				}
-				node.Attr[idx].Val = string(link)
 			}
 		} else if node.Data == "a" {
 			visitText = false
diff --git a/modules/markup/html_test.go b/modules/markup/html_test.go
index 1e39be401ba0a..5c65c83d0a0f1 100644
--- a/modules/markup/html_test.go
+++ b/modules/markup/html_test.go
@@ -408,3 +408,23 @@ func Test_ParseClusterFuzz(t *testing.T) {
 
 	assert.NotContains(t, string(val), "<html")
 }
+
+func TestIssue16020(t *testing.T) {
+	setting.AppURL = AppURL
+	setting.AppSubURL = AppSubURL
+
+	var localMetas = map[string]string{
+		"user": "go-gitea",
+		"repo": "gitea",
+	}
+
+	data := `<img src="data:image/png;base64,i//V"/>`
+
+	var res strings.Builder
+	err := PostProcess(&RenderContext{
+		URLPrefix: "https://example.com",
+		Metas:     localMetas,
+	}, strings.NewReader(data), &res)
+	assert.NoError(t, err)
+	assert.Equal(t, data, res.String())
+}

From e63c4021399b585c5511210c7ab1133a26184c3e Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Wed, 9 Jun 2021 15:27:14 +0200
Subject: [PATCH 2/2] fix test

---
 modules/markup/html_test.go | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/modules/markup/html_test.go b/modules/markup/html_test.go
index 5c65c83d0a0f1..aab2230859c73 100644
--- a/modules/markup/html_test.go
+++ b/modules/markup/html_test.go
@@ -420,11 +420,8 @@ func TestIssue16020(t *testing.T) {
 
 	data := `<img src="data:image/png;base64,i//V"/>`
 
-	var res strings.Builder
-	err := PostProcess(&RenderContext{
-		URLPrefix: "https://example.com",
-		Metas:     localMetas,
-	}, strings.NewReader(data), &res)
+	// func PostProcess(rawHTML []byte, urlPrefix string, metas map[string]string, isWikiMarkdown bool) ([]byte, error)
+	res, err := PostProcess([]byte(data), "https://example.com", localMetas, false)
 	assert.NoError(t, err)
-	assert.Equal(t, data, res.String())
+	assert.Equal(t, data, string(res))
 }