commit e237a35

default  ·  2025-02-13 18:38:54 +0000 UTC
parent 4ccb52d 
Drop SVG attachments, as they may include JavaScript.
1 files changed,  +5, -0
M html.c
M html.c
+5, -0 
 1@@ -2242,6 +2242,11 @@ xs_html *html_entry(snac *user, xs_dict *msg, int read_only,
 2             if (content && xs_str_in(content, o_href) != -1)
 3                 continue;
 4 
 5+            /* drop silently any attachment that may include JavaScript */
 6+            if (strcmp(type, "image/svg+xml") == 0 ||
 7+                strcmp(type, "text/html") == 0)
 8+                continue;
 9+
10             /* do this attachment include an icon? */
11             const xs_dict *icon = xs_dict_get(a, "icon");
12             if (xs_type(icon) == XSTYPE_DICT) {