Skip to content

Conversation

@gabrielformica
Copy link

@gabrielformica gabrielformica commented Jun 19, 2025

What

This PR adds support for svg and related tags (path, rect, circle, line, polyline, polygon, path, g) in the html5 scrubber.

How

  • added scrub functions, but let me know if this should be change to Meta.allow_tags_with_these_attributes
  • from the allowed attributes, there's an extra check for fill and stroke to make sure there's no reference url(...), javascript:

Security

From the list of attributes, it seems the only problematic ones might be fill and stroke due to url(...) being a potential value

Extra

Added body to the list of tags allowing style

Test

Finished in 0.1 seconds (0.1s async, 0.00s sync)
195 tests, 0 failures

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant