Repository navigation
[pull] main from miniflux:main - #223
Merged
Merged
Conversation
As stated in [golang.org/x/net/html's documentation](https://pkg.go.dev/golang.org/x/net): > If your use case requires semantically well-formed HTML documents, as defined by the WHATWG specification, the parser should be used rather than the tokenizer. The sanitizer is modifying the HTML document, and I'm pretty sure we don't want to implement a WHATWG-compliant parser ourself, as there are _so many_ edge cases everywhere. Picking the parser instead of the tokenizer ensures that miniflux has the same view of the DOM than web browsers, removing the risk of disparities, and thus injection-related security issues. Another benefit of this commit is to make the code way more readable/simple. The only changes made to the testsuites are: - Removing the trailing `/` on self-contained tags, as the spec doesn't require them. Adding them systematically could also have been done, but as the testsuite isn't consistent in this regard, it would have significantly increased the size of the commit to normalize it. - Some weird things that were wrong in the first place, like how `<td rowspan="<b>injection</b>">text</td>` is interpreted by the browser as `text`, and not as `<td rowspan="<b>test</b>">test</td>`. Care has been taken to re-use as much code from the tokenizer-based sanitizer as possible.
…ribute The browser will do the right thing by default even if the image width is larger than Miniflux's layout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )