diff --git a/lib/pleroma/html.ex b/lib/pleroma/html.ex
index 7f1dbe28c..2c701adb5 100644
--- a/lib/pleroma/html.ex
+++ b/lib/pleroma/html.ex
@@ -105,7 +105,14 @@ defmodule Pleroma.HTML.Scrubber.TwitterText do
# links
Meta.allow_tag_with_uri_attributes("a", ["href", "data-user", "data-tag"], @valid_schemes)
- Meta.allow_tag_with_these_attributes("a", ["name", "title", "class"])
+
+ Meta.allow_tag_with_this_attribute_values("a", "class", [
+ "hashtag",
+ "u-url",
+ "mention",
+ "u-url mention",
+ "mention u-url"
+ ])
Meta.allow_tag_with_this_attribute_values("a", "rel", [
"tag",
@@ -114,12 +121,15 @@ defmodule Pleroma.HTML.Scrubber.TwitterText do
"noreferrer"
])
+ Meta.allow_tag_with_these_attributes("a", ["name", "title"])
+
# paragraphs and linebreaks
Meta.allow_tag_with_these_attributes("br", [])
Meta.allow_tag_with_these_attributes("p", [])
# microformats
- Meta.allow_tag_with_these_attributes("span", ["class"])
+ Meta.allow_tag_with_this_attribute_values("span", "class", ["h-card"])
+ Meta.allow_tag_with_these_attributes("span", [])
# allow inline images for custom emoji
@allow_inline_images Keyword.get(@markup, :allow_inline_images)
@@ -154,7 +164,14 @@ defmodule Pleroma.HTML.Scrubber.Default do
Meta.strip_comments()
Meta.allow_tag_with_uri_attributes("a", ["href", "data-user", "data-tag"], @valid_schemes)
- Meta.allow_tag_with_these_attributes("a", ["name", "title", "class"])
+
+ Meta.allow_tag_with_this_attribute_values("a", "class", [
+ "hashtag",
+ "u-url",
+ "mention",
+ "u-url mention",
+ "mention u-url"
+ ])
Meta.allow_tag_with_this_attribute_values("a", "rel", [
"tag",
@@ -163,6 +180,8 @@ defmodule Pleroma.HTML.Scrubber.Default do
"noreferrer"
])
+ Meta.allow_tag_with_these_attributes("a", ["name", "title"])
+
Meta.allow_tag_with_these_attributes("abbr", ["title"])
Meta.allow_tag_with_these_attributes("b", [])
@@ -176,11 +195,13 @@ defmodule Pleroma.HTML.Scrubber.Default do
Meta.allow_tag_with_these_attributes("ol", [])
Meta.allow_tag_with_these_attributes("p", [])
Meta.allow_tag_with_these_attributes("pre", [])
- Meta.allow_tag_with_these_attributes("span", ["class"])
Meta.allow_tag_with_these_attributes("strong", [])
Meta.allow_tag_with_these_attributes("u", [])
Meta.allow_tag_with_these_attributes("ul", [])
+ Meta.allow_tag_with_this_attribute_values("span", "class", ["h-card"])
+ Meta.allow_tag_with_these_attributes("span", [])
+
@allow_inline_images Keyword.get(@markup, :allow_inline_images)
if @allow_inline_images do
diff --git a/test/html_test.exs b/test/html_test.exs
index 0b5d3d892..08738276e 100644
--- a/test/html_test.exs
+++ b/test/html_test.exs
@@ -20,6 +20,18 @@ defmodule Pleroma.HTMLTest do
"""
+ @html_span_class_sample """
+ hi
+ """
+
+ @html_span_microformats_sample """
+ @foo
+ """
+
+ @html_span_invalid_microformats_sample """
+ @foo
+ """
+
describe "StripTags scrubber" do
test "works as expected" do
expected = """
@@ -64,6 +76,36 @@ test "does not allow attribute-based XSS" do
assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.TwitterText)
end
+
+ test "does not allow spans with invalid classes" do
+ expected = """
+ hi
+ """
+
+ assert expected ==
+ HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.TwitterText)
+ end
+
+ test "does allow microformats" do
+ expected = """
+ @foo
+ """
+
+ assert expected ==
+ HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.TwitterText)
+ end
+
+ test "filters invalid microformats markup" do
+ expected = """
+ @foo
+ """
+
+ assert expected ==
+ HTML.filter_tags(
+ @html_span_invalid_microformats_sample,
+ Pleroma.HTML.Scrubber.TwitterText
+ )
+ end
end
describe "default scrubber" do
@@ -88,5 +130,34 @@ test "does not allow attribute-based XSS" do
assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.Default)
end
+
+ test "does not allow spans with invalid classes" do
+ expected = """
+ hi
+ """
+
+ assert expected == HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.Default)
+ end
+
+ test "does allow microformats" do
+ expected = """
+ @foo
+ """
+
+ assert expected ==
+ HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.Default)
+ end
+
+ test "filters invalid microformats markup" do
+ expected = """
+ @foo
+ """
+
+ assert expected ==
+ HTML.filter_tags(
+ @html_span_invalid_microformats_sample,
+ Pleroma.HTML.Scrubber.Default
+ )
+ end
end
end