Strip embedded SVG images for now (#2135)

Fix https://github.com/FreshRSS/FreshRSS/issues/2106
Proper SVG support would require custom sanitizing and URL rewriting of
xlink:href, and is left for future work
pull/2137/head^2
Alexandre Alapetite 6 years ago committed by GitHub
parent f26b8f3f31
commit 9f6919ae81
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 1
      lib/lib_rss.php

@ -226,6 +226,7 @@ function customSimplePie($attributes = array()) {
'font', 'form', 'frame', 'frameset', 'html',
'link', 'input', 'marquee', 'meta', 'noscript',
'object', 'param', 'plaintext', 'script', 'style',
'svg', //TODO: Support SVG after sanitizing and URL rewriting of xlink:href
));
$simplePie->strip_attributes(array_merge($simplePie->strip_attributes, array(
'autoplay', 'class', 'onload', 'onunload', 'onclick', 'ondblclick', 'onmousedown', 'onmouseup',

Loading…
Cancel
Save