mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 14:08:45 -04:00
0187b15c8e
* Sanitizer: block data: URI scheme, keep data:image for images FreshRSS_SimplePieCustom only disallowed the `javascript` scheme, so `data:text/html,...` URIs in feed content survived sanitization on <a href>, <iframe src>, <audio|video|source|track src>. The default CSP neutralises these on FreshRSS pages, but clients and deployments without that CSP (API WebViews, extensions using amendCsp(), proxies stripping headers) could execute them. Same class as GHSA-3fw6-j8m4-82vj / #9272. - Sanitize::is_allowed_uri(): element/attribute-aware check that still permits inert `data:image/...` on img[src], image[src], video[poster] while blocking `data:` elsewhere; replace_urls() now uses it. is_allowed_scheme() is unchanged for backward compatibility. - SimplePieCustom: disallow_uri_schemes(['javascript','data']). - Tests: 4 blocked-input cases, a data:image keep-alive test and an `unsafe:` prefix test. They fail without the patch and pass with it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Sync SimplePie https://github.com/FreshRSS/simplepie/pull/92 --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>