Repository navigation
Sanitize: element-aware URI scheme check so data: can be disallowed without losing data:image - #92
Merged
Conversation
…ithout losing data:image replace_urls() only consulted is_allowed_scheme(), a plain scheme blocklist, so consumers could not disallow `data:` without also breaking inert `data:image/...` on <img>. Add is_allowed_uri(tag, attribute, uri): when `data` is disallowed it still permits data:image/... on img[src], image[src] and video[poster], and blocks `data:` everywhere else (<a href>, <iframe src>, media src, ...). is_allowed_scheme() is unchanged. Companion to FreshRSS/FreshRSS#9417. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
lordmarrik
force-pushed
the
block-data-uri-scheme
branch
from
October 10, 2026 15:09
4285e19 to
908d878
Compare
Alkarex
approved these changes
Oct 10, 2026
Alkarex
added a commit
to lordmarrik/FreshRSS
that referenced
this pull request
Oct 10, 2026
Alkarex
added a commit
to FreshRSS/FreshRSS
that referenced
this pull request
Oct 11, 2026
…#9417) * Sanitizer: block data: URI scheme, keep data:image for images FreshRSS_SimplePieCustom only disallowed the `javascript` scheme, so `data:text/html,...` URIs in feed content survived sanitization on <a href>, <iframe src>, <audio|video|source|track src>. The default CSP neutralises these on FreshRSS pages, but clients and deployments without that CSP (API WebViews, extensions using amendCsp(), proxies stripping headers) could execute them. Same class as GHSA-3fw6-j8m4-82vj / #9272. - Sanitize::is_allowed_uri(): element/attribute-aware check that still permits inert `data:image/...` on img[src], image[src], video[poster] while blocking `data:` elsewhere; replace_urls() now uses it. is_allowed_scheme() is unchanged for backward compatibility. - SimplePieCustom: disallow_uri_schemes(['javascript','data']). - Tests: 4 blocked-input cases, a data:image keep-alive test and an `unsafe:` prefix test. They fail without the patch and pass with it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Sync SimplePie FreshRSS/simplepie#92 --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Alkarex
pushed a commit
to FreshRSS/FreshRSS
that referenced
this pull request
Oct 16, 2026
Adds ImperfectBlu to CREDITS.md, following #9417 and FreshRSS/simplepie#92.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to FreshRSS/FreshRSS#9417 (private advisory GHSA-5pmx-x7q6-hv7m), filed here at @Inverle's request.
What
Sanitize::replace_urls()only consultedis_allowed_scheme(), a plain scheme blocklist. That makes it impossible to disallowdata:without also losingdata:image/...on<img>, which is inert and widely used by feeds. So consumers either keepdata:fully open (allowing<a href="data:text/html,...">and<iframe src="data:...">) or break inline images.How
Sanitize::is_allowed_uri(string $tag, string $attribute, string $uri): element/attribute-aware. Whendatais in the disallowed list it still permitsdata:image/...onimg[src],image[src]andvideo[poster];data:is blocked everywhere else.replace_urls()now callsis_allowed_uri().is_allowed_scheme()is unchanged, so behaviour is identical for any consumer that does not disallowdata.FreshRSS enables this via
disallow_uri_schemes(['javascript', 'data'])in FreshRSS/FreshRSS#9417, where the regression tests live.Found and drafted with AI assistance (Claude Code), reviewed by me.