From 4690b64a99c6b4af92e7cc868ead71a0e51e44c4 Mon Sep 17 00:00:00 2001
From: xfy <i@rua.plus>
Date: Mon, 22 Jun 2026 17:57:05 +0800
Subject: [PATCH] feat(sanitizer): allow data-src/class/style on img for
 blur-up

---
 src/api/sanitizer.rs | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/api/sanitizer.rs b/src/api/sanitizer.rs
index eb0af78..9a23619 100644
--- a/src/api/sanitizer.rs
+++ b/src/api/sanitizer.rs
@@ -344,7 +344,8 @@ pub fn clean_html(input: &str) -> String {
         ],
         extra_tag_attrs: vec![
             ("a", vec!["class", "aria-hidden", "aria-label"]),
-            ("span", vec!["class"]),
+            ("img", vec!["data-src", "class", "style"]),
+            ("span", vec!["class", "style"]),
             ("h1", vec!["id", "class"]),
             ("h2", vec!["id", "class"]),
             ("h3", vec!["id", "class"]),
@@ -389,6 +390,15 @@ pub fn clean_comment_html(input: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn clean_html_allows_blur_img_attributes() {
+        let input = r#"<span class="blur-img" style="--ar:16/9"><img class="blur-img-placeholder" src="/uploads/x.webp?w=20" alt="t"><img class="blur-img-full" data-src="/uploads/x.webp?w=800" alt="t"></span>"#;
+        let result = clean_html(input);
+        assert!(result.contains("data-src"), "data-src should be allowed");
+        assert!(result.contains("blur-img-placeholder"), "class should be allowed");
+        assert!(result.contains("--ar"), "style should be allowed");
+    }
+
     #[test]
     fn safe_tags_preserved() {
         assert_eq!(clean_html("<p>safe</p>"), "<p>safe</p>");