search

pypa / readme_renderer

Safely render long_description/README files in Warehouse
Apache License 2.0
157 stars 88 forks source link

Allow width, height, alt, and align attributes on img tags. #91

Closed theacodes closed 6 years ago

theacodes commented 6 years ago

Fixes #44.

Note: warehouse sets max-width: 100% for all img tags within the project description. This prevents users from being able to completely break the page layout if they set width to something ludicrous such as 100000%.

theacodes commented 6 years ago

@dstufft (& @di) it would be great if you can take a quick look at this due to me relaxing the filter.

dstufft commented 6 years ago

Can align be used to do anything nefarious?

theacodes commented 6 years ago

Not that I'm aware of (we already allow it on the table family of tags)

theacodes commented 6 years ago

Thanks, @dstufft!

westurner commented 6 years ago

This doesn't work (yet?) See: https://github.com/dcowden/cadquery/issues/288

di commented 6 years ago

@westurner It seems like something has changed and those images are being rendered with the style attribute instead, which is being removed by PyPI:

<img
  alt="https://www.python.org/static/community_logos/python-logo-master-v3-TM.png" 
  src="https://www.python.org/static/community_logos/python-logo-master-v3-TM.png"
  style="width: 100px;"
>

@theacodes any ideas?

di commented 6 years ago

Oh, looks like we just haven't released #114 yet.

westurner commented 6 years ago

See the comment re bleach.sanitizer.ALLOWED_STYLES on #114.

https://bleach.readthedocs.io/en/latest/clean.html#allowed-styles-styles

On Saturday, September 15, 2018, Dustin Ingram notifications@github.com wrote:

Oh, looks like we just haven't released #114 https://github.com/pypa/readme_renderer/pull/114 yet.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/pypa/readme_renderer/pull/91#issuecomment-421662665, or mute the thread https://github.com/notifications/unsubscribe-auth/AADGy83GBwmQAsuHup5jcNcHhcI7GXQbks5ubZ77gaJpZM4TUWz_ .