matrix-org/synapse
Upgrade to Bleach 1.5, to limit link schemes to an allowlist
オープン
#2,860 opened on 2018/02/09
A-Email-PushP4T-EnhancementZ-Help-Wantedgood first issue
Repository metrics
- Stars
- (11,713 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
The 1.5 version of Bleach made the allowed protocols configurable: http://bleach.readthedocs.io/en/latest/clean.html#allowed-protocols-protocols
Once the dependency is updated, the safe_markup function in the mailer can be updated and these lines can be uncommented: https://github.com/matrix-org/synapse/blob/42b50483be2b022735f8ae2107314d51e92e8471/synapse/push/mailer.py#L76-L77