search

calzoneman / sync

Node.JS Server and JavaScript/HTML Client for synchronizing online media
Other
1.47k stars 232 forks source link

sanitize-html broke default strikethrough filter #429

Closed ghost closed 9 years ago

ghost commented 9 years ago

The default strikethrough filter was broken by the sanitize-html merge, caused by the <s> tag not being in any of the whitelists. The library's default tag whitelist only includes the deprecated-in-HTML4 <strike> tag and it's not in CyTube's added whitelist either.

The <s> tags have disappeared on the chansettings filter page entirely, so there might be a chandump issue as well.

calzoneman commented 9 years ago

I have just whitelisted the <s> tag: https://github.com/calzoneman/sync/commit/9fc1cbd81c2aeae84dbf676d56f742fac31be659

I will probably restart the server tomorrow morning to reflect this.

The <s> tags have disappeared on the chansettings filter page entirely, so there might be a chandump issue as well.

Any channel that was loaded while the <s> tag was not whitelisted will have the tag removed from the filter. This is intentional so that filters that were added before the whitelist (or, in rare cases, before the XSS filter even existed) will be sanitized. I performed an analysis of every channel's chat filters to determine which safe tags were in use when building the whitelist; unfortunately since <s> was not included, manual intervention will be required to fix this filter.