public/docs/release-notes.md

@@ -8,6 +8,7 @@
 - Added external link warning setting (`externalLinkWarning` in config.json or `CMD_EXTERNAL_LINK_WARNING`) to disable the external link warning page entirely
 - Fixed external link warning for subpath instances
 - Enabled `.webp` for file uploads (for all backends but `imgur`, since it does not support it)
+- Removed unnecessary entries in the XSS whitelist
 
 ### Bugfixes
 

public/js/render.js

@@ -18,22 +18,14 @@ whiteList.ol = ['start']
 whiteList.li = ['value']
 // allow style tag
 whiteList.style = []
-// allow kbd tag
-whiteList.kbd = []
 // allow ifram tag with some safe attributes
 whiteList.iframe = ['allowfullscreen', 'name', 'referrerpolicy', 'src', 'width', 'height']
-// allow summary tag
-whiteList.summary = []
 // allow ruby tag
 whiteList.ruby = []
 // allow rp tag for ruby
 whiteList.rp = []
 // allow rt tag for ruby
 whiteList.rt = []
-// allow figure tag
-whiteList.figure = []
-// allow figcaption tag
-whiteList.figcaption = []
 
 const filterXSSOptions = {
   allowCommentTag: true,