From 5c8794ba0c9ddcb51f0ad8e405717839e35bded4 Mon Sep 17 00:00:00 2001 From: Niclas Overby Date: Wed, 25 Mar 2026 20:30:20 +0000 Subject: [PATCH] appview/pages: allow picture and source elements in sanitizer The HTML sanitizer was stripping and elements from rendered markdown, preventing modern image format usage (e.g. AVIF with fallbacks). Allow these elements and their relevant attributes (srcset, type, media). Signed-off-by: Niclas Overby --- appview/pages/markup/sanitizer.go | 4 ++++ 1 file(s) changed, 4 insertion(s)(+), 0 deletion(s)(-) diff --git a/appview/pages/markup/sanitizer.go b/appview/pages/markup/sanitizer.go --- a/appview/pages/markup/sanitizer.go +++ b/appview/pages/markup/sanitizer.go @@ -71,12 +71,16 @@ "dl", "dt", "dd", "kbd", "q", "samp", "var", "hr", "ruby", "rt", "rp", "li", "tr", "td", "th", "s", "strike", "summary", "details", "caption", "figure", "figcaption", "abbr", "bdo", "cite", "dfn", "mark", "small", "span", "time", "video", "wbr", + "picture", "source", } policy.AllowAttrs(generalSafeAttrs...).OnElements(generalSafeElements...) // video policy.AllowAttrs("src", "autoplay", "controls").OnElements("video") + + // picture/source for modern image formats (avif, webp, etc.) + policy.AllowAttrs("srcset", "type", "media").OnElements("source") // checkboxes policy.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input") -- tangled.sh