hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(html): check link schemes the way browsers read them

Browse source 
FastSanitize checks the scheme with URI.parse/1, which finds none in
java<TAB>script:alert(1). Browsers remove tabs and newlines and leading
control characters first and run it as a javascript: link. The scrubbers
now use Pleroma.HTML.URIAttributes, which normalizes the URL the same
way before the scheme check.
This commit is contained in:
Lain Soykaf 2026-10-22 16:30:38 +04:00
commit 1be50ed28b
No known key found for this signature in database
6 changed files with 95 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
priv/scrubbers/default.ex
View file

@ -6,6 +6,7 @@ defmodule Pleroma.HTML.Scrubber.Default do
@doc "The default HTML scrubbing policy: no "
require FastSanitize.Sanitizer.Meta
require Pleroma.HTML.URIAttributes
alias FastSanitize.Sanitizer.Meta
# credo:disable-for-previous-line
@ -15,7 +16,11 @@ defmodule Pleroma.HTML.Scrubber.Default do
Meta.strip_comments()
Meta.allow_tag_with_uri_attributes(:a, ["href", "data-user", "data-tag"], @valid_schemes)
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(
:a,
["href", "data-user", "data-tag"],
@valid_schemes
)
Meta.allow_tag_with_this_attribute_values(:a, "class", [
"hashtag",
@ -145,7 +150,7 @@ defmodule Pleroma.HTML.Scrubber.Default do
Meta.allow_tag_with_this_attribute_values(:img, "class", ["emoji"])
# restrict img tags to http/https only, because of MediaProxy.
Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
Meta.allow_tag_with_these_attributes(:img, [
"width",

3
priv/scrubbers/links_only.ex
View file

@ -10,12 +10,13 @@ defmodule Pleroma.HTML.Scrubber.LinksOnly do
@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])
require FastSanitize.Sanitizer.Meta
require Pleroma.HTML.URIAttributes
alias FastSanitize.Sanitizer.Meta
Meta.strip_comments()
# links
Meta.allow_tag_with_uri_attributes(:a, ["href"], @valid_schemes)
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:a, ["href"], @valid_schemes)
Meta.allow_tag_with_this_attribute_values(:a, "rel", [
"tag",

9
priv/scrubbers/twitter_text.ex
View file

@ -11,12 +11,17 @@ defmodule Pleroma.HTML.Scrubber.TwitterText do
@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])
require FastSanitize.Sanitizer.Meta
require Pleroma.HTML.URIAttributes
alias FastSanitize.Sanitizer.Meta
Meta.strip_comments()
# links
Meta.allow_tag_with_uri_attributes(:a, ["href", "data-user", "data-tag"], @valid_schemes)
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(
:a,
["href", "data-user", "data-tag"],
@valid_schemes
)
Meta.allow_tag_with_this_attribute_values(:a, "class", [
"hashtag",
@ -49,7 +54,7 @@ defmodule Pleroma.HTML.Scrubber.TwitterText do
Meta.allow_tag_with_this_attribute_values(:img, "class", ["emoji"])
# restrict img tags to http/https only, because of MediaProxy.
Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
Meta.allow_tag_with_these_attributes(:img, [
"width",