ammonia
ammonia copied to clipboard
Set URL schemes for a href & img src distinctly
I would like to allow href, but only an img's src if the scheme is data. (Because it will load without interaction, which I don't want to allow if it's external.)
Presently, I believe this is possible only with attribute_filter, and some manual parsing to look at the scheme (I suppose just 'starts with?' would suffice though).
I think it would be nice to have either a new API for selectively whitelisting/removing from only one of them (img_schemes & anchor_schemes perhaps) or somehow add the option of selectivity to the existing methods.
Would be even nicer if these filters could have their own non-literal subfilters (or an orthogonal less contextual filter) so it's possible to e.g. only allow data:image/* data urls and forbid the rest, or only allow that under a certain threshold of image, or even be able to parse the image to filter it (inlining small images in HTML is a pretty big and relatively safe use-case for data URLs, others maybe less so).