Open snap9 opened 7 years ago
This is easy to add: I pushed a srcset branch.
However, this attribute is not in my reference implementation: https://github.com/html5lib/html5lib-python/blob/master/html5lib/filters/sanitizer.py A goal of this library is to have 3rd-party vetting of the safety of the sanitization.
ok, that implementation is stalled. srcset looks like it can be treated just like src
I'm using imgsrc to support high-resolution display images: https://webkit.org/demos/srcset/
Your XSS strips this down to
It just gets rid of the
srcset
. Why, and ifsrcset
isn't really dangerous, can you consider whitelisting it?