user01/calibre-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Clean atributes as well in clean_string

Browse Source 
`<img src=x onerror=alert(1)>` womp womp
This commit is contained in:
jvoisin
2026-04-15 23:30:49 +02:00
parent fca580505c
commit 8cff413c4d
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
cps/clean_html.py
View File

@@ -36,7 +36,12 @@ def clean_string(unsafe_text, book_id=0):
if bleach: if bleach:
allowed_tags = list(ALLOWED_TAGS) allowed_tags = list(ALLOWED_TAGS)
allowed_tags.extend(["p", "span", "div", "pre", "br", "h1", "h2", "h3", "h4", "h5", "h6", "img"]) allowed_tags.extend(["p", "span", "div", "pre", "br", "h1", "h2", "h3", "h4", "h5", "h6", "img"])
safe_text = clean_html(unsafe_text, tags=set(allowed_tags)) allowed_attributes = {
"*": ["class", "style"],
"a": ["href", "title", "rel"],
"img": ["src", "alt", "title", "width", "height"],
}
safe_text = clean_html(unsafe_text, tags=set(allowed_tags), attributes=allowed_attributes)
else: else:
safe_text = clean_html(unsafe_text) safe_text = clean_html(unsafe_text)
except ParserError as e: except ParserError as e: