You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I would like to allow href, but only an img's src if the scheme is data. (Because it will load without interaction, which I don't want to allow if it's external.)
Presently, I believe this is possible only with attribute_filter, and some manual parsing to look at the scheme (I suppose just 'starts with?' would suffice though).
I think it would be nice to have either a new API for selectively whitelisting/removing from only one of them (img_schemes & anchor_schemes perhaps) or somehow add the option of selectivity to the existing methods.
The text was updated successfully, but these errors were encountered:
Would be even nicer if these filters could have their own non-literal subfilters (or an orthogonal less contextual filter) so it's possible to e.g. only allow data:image/* data urls and forbid the rest, or only allow that under a certain threshold of image, or even be able to parse the image to filter it (inlining small images in HTML is a pretty big and relatively safe use-case for data URLs, others maybe less so).
I would like to allow
href
, but only animg
'ssrc
if the scheme isdata
. (Because it will load without interaction, which I don't want to allow if it's external.)Presently, I believe this is possible only with
attribute_filter
, and some manual parsing to look at the scheme (I suppose just 'starts with?' would suffice though).I think it would be nice to have either a new API for selectively whitelisting/removing from only one of them (
img_schemes
&anchor_schemes
perhaps) or somehow add the option of selectivity to the existing methods.The text was updated successfully, but these errors were encountered: