src/Html.vala: strip data-user attribute

bleakgrey / tootle

GTK-based Mastodon client for Linux

GNU General Public License v3.0

400 stars 61 forks source link

Closed lanodan closed 3 years ago

lanodan commented 5 years ago

Fixes: Failed to set text '@… …' from markup due to error parsing markup: Attribute 'data-user' is not allowed on the tag on line 1 char 75

lanodan commented 5 years ago

Note: This might be a Pleroma-specific issue as Mastodon could strip this tag from our formatting.

riking commented 5 years ago

If you're passing external HTML to GTK, you should probably be applying a strict whitelist and rewriting the semantics of the data-* attributes.

lanodan commented 5 years ago

Looking at Pleroma’s HTML scrubber as a base for which attributes to keep I think only a.href and maybe img.src should be kept.

Pleroma is allowing a.data-user and a.data-tag on links but I think theses are useless for MastodonAPI clients.