fix some XSS maybe

Signed-off-by: Sam Therapy <sam@samtherapy.net>
2022-11-26 18:07:28 +01:00 · 2022-11-26 18:07:28 +01:00 · 1f1b72a11f
parent 7ad1637a7a
commit 1f1b72a11f
1 changed files with 2 additions and 1 deletions
--- a/priv/scrubbers/default.ex
+++ b/priv/scrubbers/default.ex
@ -71,10 +71,11 @@ defmodule Pleroma.HTML.Scrubber.Default do
    # restrict img tags to http/https only, because of MediaProxy.
    Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])

+    Meta.allow_tag_with_this_attribute_values(:img, ["class"], ["emoji"])
+
    Meta.allow_tag_with_these_attributes(:img, [
      "width",
      "height",
-      "class",
      "title",
      "alt"
    ])