Clean atributes as well in clean_string

`<img src=x onerror=alert(1)>` womp womp
2026-04-15 23:30:49 +02:00
parent fca580505c
commit 8cff413c4d
1 changed files with 6 additions and 1 deletions
--- a/cps/clean_html.py
+++ b/cps/clean_html.py
@@ -36,7 +36,12 @@ def clean_string(unsafe_text, book_id=0):
        if bleach:
            allowed_tags = list(ALLOWED_TAGS)
            allowed_tags.extend(["p", "span", "div", "pre", "br", "h1", "h2", "h3", "h4", "h5", "h6", "img"])
-            safe_text = clean_html(unsafe_text, tags=set(allowed_tags))
+            allowed_attributes = {
+                "*": ["class", "style"],
+                "a": ["href", "title", "rel"],
+                "img": ["src", "alt", "title", "width", "height"],
+            }
+            safe_text = clean_html(unsafe_text, tags=set(allowed_tags), attributes=allowed_attributes)
        else:
            safe_text = clean_html(unsafe_text)
    except ParserError as e: