search

element-hq / element-meta

Shared/meta documentation and project artefacts for Element clients
65 stars 11 forks source link

Support `s` tags for strikethrough #2368

Open Erquint opened 3 months ago

Erquint commented 3 months ago

Opening this issue as a reminder that the <s> tag shouldn't be escaped anymore.

I've been informed that, starting from tomorrow, Matrix protocol specification strongly suggests clients to permit a set of HTML tags, now again including s, as detailed here.

This is changing tomorrow with the Matrix 1.10 spec release. s is preferred over strike, and del is maintained: https://spec.matrix.org/unstable/client-server-api/#mroommessage-msgtypes

— @travis:t2l.io

Clients should limit the HTML they render to avoid Cross-Site Scripting, HTML injection, and similar attacks. The strongly suggested set of HTML tags to permit, denying the use and rendering of anything else, is: del, h1, h2, h3, h4, h5, h6, blockquote, p, a, ul, ol, sup, sub, li, b, i, u, strong, em, s, code, hr, br, div, table, thead, tbody, tr, th, td, caption, pre, span, img, details, summary.

— Client-Server API | Matrix Specification

Outcome

Currently, sending <s>Strikethrough</s> results in posting \<s>Strikethrough\</s>.

Operating system

Windows/Web

Application version

Future

dbkr commented 3 months ago

I think this should be a question of just adding the tag to the allowed list, so a bite-sized thing for a maintainer or even a first-time contributor.