refactor(xssWhitelist): remove unnecessary whitelist entries

All the deleted entries are in the default white contained and don't need to be added another time.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
This commit is contained in:
Philip Molares
2026-07-22 20:15:59 +02:00
committed by Erik Michelson
parent 1a7c27470e
commit 3f50054609
2 changed files with 1 additions and 8 deletions

View File

@@ -8,6 +8,7 @@
- Added external link warning setting (`externalLinkWarning` in config.json or `CMD_EXTERNAL_LINK_WARNING`) to disable the external link warning page entirely - Added external link warning setting (`externalLinkWarning` in config.json or `CMD_EXTERNAL_LINK_WARNING`) to disable the external link warning page entirely
- Fixed external link warning for subpath instances - Fixed external link warning for subpath instances
- Enabled `.webp` for file uploads (for all backends but `imgur`, since it does not support it) - Enabled `.webp` for file uploads (for all backends but `imgur`, since it does not support it)
- Removed unnecessary entries in the XSS whitelist
### Bugfixes ### Bugfixes

View File

@@ -18,22 +18,14 @@ whiteList.ol = ['start']
whiteList.li = ['value'] whiteList.li = ['value']
// allow style tag // allow style tag
whiteList.style = [] whiteList.style = []
// allow kbd tag
whiteList.kbd = []
// allow ifram tag with some safe attributes // allow ifram tag with some safe attributes
whiteList.iframe = ['allowfullscreen', 'name', 'referrerpolicy', 'src', 'width', 'height'] whiteList.iframe = ['allowfullscreen', 'name', 'referrerpolicy', 'src', 'width', 'height']
// allow summary tag
whiteList.summary = []
// allow ruby tag // allow ruby tag
whiteList.ruby = [] whiteList.ruby = []
// allow rp tag for ruby // allow rp tag for ruby
whiteList.rp = [] whiteList.rp = []
// allow rt tag for ruby // allow rt tag for ruby
whiteList.rt = [] whiteList.rt = []
// allow figure tag
whiteList.figure = []
// allow figcaption tag
whiteList.figcaption = []
const filterXSSOptions = { const filterXSSOptions = {
allowCommentTag: true, allowCommentTag: true,