xfy/yggdrasil
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat(sanitizer): allow data-src/class/style on img for blur-up

Browse Source
This commit is contained in:
xfy 2026-06-22 17:57:05 +08:00
parent 45d14e2ad9
commit 4690b64a99
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/api/sanitizer.rs
View File

@ -344,7 +344,8 @@ pub fn clean_html(input: &str) -> String {
],
extra_tag_attrs: vec![
("a", vec!["class", "aria-hidden", "aria-label"]),
("span", vec!["class"]),
("img", vec!["data-src", "class", "style"]),
("span", vec!["class", "style"]),
("h1", vec!["id", "class"]),
("h2", vec!["id", "class"]),
("h3", vec!["id", "class"]),
@ -389,6 +390,15 @@ pub fn clean_comment_html(input: &str) -> String {
mod tests {
use super::*;
#[test]
fn clean_html_allows_blur_img_attributes() {
let input = r#"<span class="blur-img" style="--ar:16/9"><img class="blur-img-placeholder" src="/uploads/x.webp?w=20" alt="t"><img class="blur-img-full" data-src="/uploads/x.webp?w=800" alt="t"></span>"#;
let result = clean_html(input);
assert!(result.contains("data-src"), "data-src should be allowed");
assert!(result.contains("blur-img-placeholder"), "class should be allowed");
assert!(result.contains("--ar"), "style should be allowed");
}
#[test]
fn safe_tags_preserved() {
assert_eq!(clean_html("<p>safe</p>"), "<p>safe</p>");