search

Rudxain / custom-emoji-inliner

takes a table of icon URLs, and it'll replace ":emoji_id:" by its corresponding <img> within any input file
Mozilla Public License 2.0
1 stars 0 forks source link

Implement mixed-content warning #2

Open Rudxain opened 9 months ago

Rudxain commented 9 months ago

Print a warning if the URI-schemes seem to mix encrypted protocols with plain-text protocols.

This is for security and privacy reasons, considering SVGs allow execution of JS.

TLS and SSH don't simply encrypt data, they also authenticate the provider, thereby proving the source is "the real one".

Rudxain commented 9 months ago

This can backfire, as URI-schemes don't provide all info. A URL can be https but the browser may fall-back to http because the server "doesn't support it". Some http URLs may be auto-upgraded by the browser, thereby making https scheme a "waste of bytes"