Implement whitelist for sanitizer: allowed_html_elements_with_attributes()#53
Implement whitelist for sanitizer: allowed_html_elements_with_attributes()#53Alkarex merged 12 commits intoFreshRSS:freshrssfrom
allowed_html_elements_with_attributes()#53Conversation
|
Maybe now |
|
Thanks 👍🏻
|
ba1255d to
8b7c7b4
Compare
|
done (test added, PR not opened yet) |
8b7c7b4 to
423a14e
Compare
|
Attempting to fix CI, have to wait for approval so no idea if this works |
|
What should be done now? |
|
Sorry for the delay. I rewrote the approach to iterate the elements and attributes. I was not so happy of the two layers of XPath.
|
WIP |
* Fixed sanitization output returning `<!DOCTYPE html>` regardless of input
* Custom elements are not allowed anymore
* Added `allow_data_attr` and `allow_aria_attr` parameters
* Don't remove children of the disallowed element
* Replaced `removeAttribute()` with `removeAttributeNS()` to ensure all disallowed attributes are removed
* For example `xmlns` was not being removed correctly
* Fixed test using incorrect variable `$sanitize` instead of `$sanitize_whitelist`
whitelist_tags()allowed_html_elements_with_attributes()
@Alkarex Please review the new changes before I do that (and run the tests workflow) I have also updated FreshRSS/FreshRSS#7924 for FreshRSS testing. Seems to work fine with my feeds |
|
Ready for review |
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
|
Though I don't understand why |
|
Looks like CI didn't print all the unsupported functions at once.. |
Yes, that would have been likely caught by simplepie#939 |
|
Everything still works |
|
Please double-check 4a16e57 and I think we are good to go |
|
Looks fine |
* Implement whitelist for SimplePie sanitizer ref: #7770 (comment) FreshRSS/simplepie#53 simplepie/simplepie#947 * Remove `<plaintext>` from whitelist * Improve order * Remove some tags from whitelist * Revert partially * sync * Display contents of `<noscript>` and `<noembed>` * sync * Allow use of `<track>` * sync again * Sync to SimplePie fork FreshRSS/simplepie#53 * Alphabetic order * Reduce list of stripped attributes * Temporarily strip some attributes --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
From FreshRSS/FreshRSS#7924