Lain Soykaf
1be50ed28b
fix(html): check link schemes the way browsers read them
...
FastSanitize checks the scheme with URI.parse/1, which finds none in
java<TAB>script:alert(1). Browsers remove tabs and newlines and leading
control characters first and run it as a javascript: link. The scrubbers
now use Pleroma.HTML.URIAttributes, which normalizes the URL the same
way before the scheme check.
2026-10-22 16:36:16 +04:00
marcin mikołajczak
37397a43be
scrubbers/default: Allow "mention hashtag" classes used by Mastodon
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2024-09-02 12:39:29 +02:00
lain
e853cfe7c3
Revert "Merge branch 'copyright-bump' into 'develop'"
...
This reverts merge request !3825
2023-01-02 20:38:50 +00:00
marcin mikołajczak
10886eeaa2
Bump copyright year
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-01-01 12:13:06 +01:00
Haelwenn (lanodan) Monnier
8f3e750530
scrubbers: Scrub img class attribute
...
Closes: https://git.pleroma.social/pleroma/pleroma/-/merge_requests/3790
2022-11-27 03:40:21 +01:00
Sean King
17aa3644be
Copyright bump for 2022
2022-02-25 23:11:42 -07:00
rinpatch
d6c89068f3
HTML: Compile Scrubbers on boot
...
This makes it possible to configure their behavior on OTP releases.
2019-12-08 20:35:41 +03:00
