From 3f50054609b86f21ff86077809b563a6ef6def9b Mon Sep 17 00:00:00 2001
From: Philip Molares <philip.molares@udo.edu>
Date: Wed, 22 Jul 2026 20:15:59 +0200
Subject: [PATCH] refactor(xssWhitelist): remove unnecessary whitelist entries

All the deleted entries are in the default white contained and don't need to be added another time.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
---
 public/docs/release-notes.md | 1 +
 public/js/render.js          | 8 --------
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md
index 02f2956e..81a41ae5 100644
--- a/public/docs/release-notes.md
+++ b/public/docs/release-notes.md
@@ -8,6 +8,7 @@
 - Added external link warning setting (`externalLinkWarning` in config.json or `CMD_EXTERNAL_LINK_WARNING`) to disable the external link warning page entirely
 - Fixed external link warning for subpath instances
 - Enabled `.webp` for file uploads (for all backends but `imgur`, since it does not support it)
+- Removed unnecessary entries in the XSS whitelist
 
 ### Bugfixes
 
diff --git a/public/js/render.js b/public/js/render.js
index 250d0a0d..78607eb9 100644
--- a/public/js/render.js
+++ b/public/js/render.js
@@ -18,22 +18,14 @@ whiteList.ol = ['start']
 whiteList.li = ['value']
 // allow style tag
 whiteList.style = []
-// allow kbd tag
-whiteList.kbd = []
 // allow ifram tag with some safe attributes
 whiteList.iframe = ['allowfullscreen', 'name', 'referrerpolicy', 'src', 'width', 'height']
-// allow summary tag
-whiteList.summary = []
 // allow ruby tag
 whiteList.ruby = []
 // allow rp tag for ruby
 whiteList.rp = []
 // allow rt tag for ruby
 whiteList.rt = []
-// allow figure tag
-whiteList.figure = []
-// allow figcaption tag
-whiteList.figcaption = []
 
 const filterXSSOptions = {
   allowCommentTag: true,