hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(html): check link schemes the way browsers read them

Browse source 
FastSanitize checks the scheme with URI.parse/1, which finds none in
java<TAB>script:alert(1). Browsers remove tabs and newlines and leading
control characters first and run it as a javascript: link. The scrubbers
now use Pleroma.HTML.URIAttributes, which normalizes the URL the same
way before the scheme check.
This commit is contained in:
Lain Soykaf 2026-10-22 16:30:38 +04:00
commit 1be50ed28b
No known key found for this signature in database
6 changed files with 95 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/scrubber-hidden-schemes.security Normal file
View file

@ -0,0 +1 @@
Scrubbers: remove links and images whose scheme is hidden with tabs, newlines or leading control characters (for example java<TAB>script:), which browsers still run as javascript:. Custom scrubbers should use Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes instead of the FastSanitize macro