Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set URL schemes for a href & img src distinctly #154

Open
OJFord opened this issue Mar 9, 2022 · 1 comment
Open

Set URL schemes for a href & img src distinctly #154

OJFord opened this issue Mar 9, 2022 · 1 comment

Comments

@OJFord
Copy link

OJFord commented Mar 9, 2022

I would like to allow href, but only an img's src if the scheme is data. (Because it will load without interaction, which I don't want to allow if it's external.)

Presently, I believe this is possible only with attribute_filter, and some manual parsing to look at the scheme (I suppose just 'starts with?' would suffice though).

I think it would be nice to have either a new API for selectively whitelisting/removing from only one of them (img_schemes & anchor_schemes perhaps) or somehow add the option of selectivity to the existing methods.

@xmo-odoo
Copy link

Would be even nicer if these filters could have their own non-literal subfilters (or an orthogonal less contextual filter) so it's possible to e.g. only allow data:image/* data urls and forbid the rest, or only allow that under a certain threshold of image, or even be able to parse the image to filter it (inlining small images in HTML is a pretty big and relatively safe use-case for data URLs, others maybe less so).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants