search

apostrophecms / sanitize-html

Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis. Built on htmlparser2 for speed and tolerance
MIT License
3.79k stars 353 forks source link

Fix #504: fix inconsistent iframe src behavior across browsers #516

Closed mattclough1 closed 2 years ago

mattclough1 commented 2 years ago

Fix #504

This solution opts to replace the relative protocol of the URL parser's base URL with the special scheme protocol https. This does not alter the original value in any way, but retains the ability to determine whether the given URL is relative.

mattclough1 commented 2 years ago

@boutell alternative approach to this one. I couldn't see any benefit to using the relative:// protocol in the base URL, but lmk if that's necessary for some reason. All tests are currently passing.

mattclough1 commented 2 years ago

Ah I see. I'll take a different approach. Interesting that the URL parser even allows a host without a top-level domain

boutell commented 2 years ago

It would need to, since on a local network that's not uncommon.

On Wed, Nov 17, 2021 at 12:06 PM Matt Clough @.***> wrote:

Ah I see. I'll take a different approach. Interesting that the URL parser even allows a host without a top-level domain

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/apostrophecms/sanitize-html/pull/516#issuecomment-971779858, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAH27OY2SWCQYLZMERHP6DUMPOKVANCNFSM5IFE5B5A . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

--

THOMAS BOUTELL | CHIEF TECHNOLOGY OFFICER APOSTROPHECMS | apostrophecms.com | he/him/his

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.