hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'audit-mix-audit-report' (#69) into release/2.11

Browse source 
# Conflicts:
#	lib/pleroma/http/adapter_helper/hackney.ex
This commit is contained in:
Lain Soykaf 2026-10-22 16:37:08 +04:00
commit 9ea8d37e9f
No known key found for this signature in database
23 changed files with 216 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

9
priv/scrubbers/default.ex
View file

@ -6,6 +6,7 @@ defmodule Pleroma.HTML.Scrubber.Default do
@doc "The default HTML scrubbing policy: no "
require FastSanitize.Sanitizer.Meta
require Pleroma.HTML.URIAttributes
alias FastSanitize.Sanitizer.Meta
# credo:disable-for-previous-line
@ -15,7 +16,11 @@ defmodule Pleroma.HTML.Scrubber.Default do
Meta.strip_comments()
Meta.allow_tag_with_uri_attributes(:a, ["href", "data-user", "data-tag"], @valid_schemes)
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(
:a,
["href", "data-user", "data-tag"],
@valid_schemes
)
Meta.allow_tag_with_this_attribute_values(:a, "class", [
"hashtag",
@ -145,7 +150,7 @@ defmodule Pleroma.HTML.Scrubber.Default do
Meta.allow_tag_with_this_attribute_values(:img, "class", ["emoji"])
# restrict img tags to http/https only, because of MediaProxy.
Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
Meta.allow_tag_with_these_attributes(:img, [
"width",

3
priv/scrubbers/links_only.ex
View file

@ -10,12 +10,13 @@ defmodule Pleroma.HTML.Scrubber.LinksOnly do
@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])
require FastSanitize.Sanitizer.Meta
require Pleroma.HTML.URIAttributes
alias FastSanitize.Sanitizer.Meta
Meta.strip_comments()
# links
Meta.allow_tag_with_uri_attributes(:a, ["href"], @valid_schemes)
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:a, ["href"], @valid_schemes)
Meta.allow_tag_with_this_attribute_values(:a, "rel", [
"tag",

9
priv/scrubbers/twitter_text.ex
View file

@ -11,12 +11,17 @@ defmodule Pleroma.HTML.Scrubber.TwitterText do
@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])
require FastSanitize.Sanitizer.Meta
require Pleroma.HTML.URIAttributes
alias FastSanitize.Sanitizer.Meta
Meta.strip_comments()
# links
Meta.allow_tag_with_uri_attributes(:a, ["href", "data-user", "data-tag"], @valid_schemes)
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(
:a,
["href", "data-user", "data-tag"],
@valid_schemes
)
Meta.allow_tag_with_this_attribute_values(:a, "class", [
"hashtag",
@ -49,7 +54,7 @@ defmodule Pleroma.HTML.Scrubber.TwitterText do
Meta.allow_tag_with_this_attribute_values(:img, "class", ["emoji"])
# restrict img tags to http/https only, because of MediaProxy.
Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
Meta.allow_tag_with_these_attributes(:img, [
"width",