ammonia icon indicating copy to clipboard operation
ammonia copied to clipboard

Set URL schemes for a href & img src distinctly

Open OJFord opened this issue 3 years ago • 1 comments

I would like to allow href, but only an img's src if the scheme is data. (Because it will load without interaction, which I don't want to allow if it's external.)

Presently, I believe this is possible only with attribute_filter, and some manual parsing to look at the scheme (I suppose just 'starts with?' would suffice though).

I think it would be nice to have either a new API for selectively whitelisting/removing from only one of them (img_schemes & anchor_schemes perhaps) or somehow add the option of selectivity to the existing methods.

OJFord avatar Mar 09 '22 21:03 OJFord

Would be even nicer if these filters could have their own non-literal subfilters (or an orthogonal less contextual filter) so it's possible to e.g. only allow data:image/* data urls and forbid the rest, or only allow that under a certain threshold of image, or even be able to parse the image to filter it (inlining small images in HTML is a pretty big and relatively safe use-case for data URLs, others maybe less so).

xmo-odoo avatar Jan 27 '23 12:01 xmo-odoo