1be50ed28bFastSanitize checks the scheme with URI.parse/1, which finds none in java<TAB>script:alert(1). Browsers remove tabs and newlines and leading control characters first and run it as a javascript: link. The scrubbers now use Pleroma.HTML.URIAttributes, which normalizes the URL the same way before the scheme check.
32 lines
841 B
Elixir
32 lines
841 B
Elixir
# Pleroma: A lightweight social networking server
|
|
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
defmodule Pleroma.HTML.Scrubber.LinksOnly do
|
|
@moduledoc """
|
|
An HTML scrubbing policy which limits to links only.
|
|
"""
|
|
|
|
@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])
|
|
|
|
require FastSanitize.Sanitizer.Meta
|
|
require Pleroma.HTML.URIAttributes
|
|
alias FastSanitize.Sanitizer.Meta
|
|
|
|
Meta.strip_comments()
|
|
|
|
# links
|
|
Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:a, ["href"], @valid_schemes)
|
|
|
|
Meta.allow_tag_with_this_attribute_values(:a, "rel", [
|
|
"tag",
|
|
"nofollow",
|
|
"noopener",
|
|
"noreferrer",
|
|
"me",
|
|
"ugc"
|
|
])
|
|
|
|
Meta.allow_tag_with_these_attributes(:a, ["name", "title"])
|
|
Meta.strip_everything_not_covered()
|
|
end
|