diff --git a/config/config.exs b/config/config.exs index dbf5393fc4..3f95255752 100644 --- a/config/config.exs +++ b/config/config.exs @@ -274,9 +274,7 @@ } config :pleroma, :markup, - # XXX - unfortunately, inline images must be enabled by default right now, because - # of custom emoji. Issue #275 discusses defanging that somehow. - allow_inline_images: true, + allow_inline_images: false, allow_headings: false, allow_tables: false, allow_fonts: false, diff --git a/config/test.exs b/config/test.exs index 28eab8e38b..f4a11aaef8 100644 --- a/config/test.exs +++ b/config/test.exs @@ -147,6 +147,10 @@ # https://dashbit.co/blog/speeding-up-re-compilation-of-elixir-projects config :phoenix, :plug_init_mode, :runtime +# Allow inline images in tests (for now). +# FIXME: rework/remove tests that depend on this. +config :pleroma, :markup, allow_inline_images: true + if File.exists?("./config/test.secret.exs") do import_config "test.secret.exs" else diff --git a/priv/scrubbers/default.ex b/priv/scrubbers/default.ex index afb94e5af7..3486a3d471 100644 --- a/priv/scrubbers/default.ex +++ b/priv/scrubbers/default.ex @@ -79,7 +79,6 @@ defmodule Pleroma.HTML.Scrubber.Default do Meta.allow_tag_with_these_attributes(:img, [ "width", "height", - "class", "title", "alt" ]) diff --git a/test/pleroma/emoji/formatter_test.exs b/test/pleroma/emoji/formatter_test.exs index 7bacea3618..2ca2d07177 100644 --- a/test/pleroma/emoji/formatter_test.exs +++ b/test/pleroma/emoji/formatter_test.exs @@ -11,7 +11,7 @@ test "it adds cool emoji" do text = "I love :firefox:" expected_result = - "I love \"firefox\"" + "I love \"firefox\"" assert Formatter.emojify(text) == expected_result end diff --git a/test/pleroma/web/activity_pub/mrf/normalize_markup_test.exs b/test/pleroma/web/activity_pub/mrf/normalize_markup_test.exs index 66a8f4e44a..530c5f4a08 100644 --- a/test/pleroma/web/activity_pub/mrf/normalize_markup_test.exs +++ b/test/pleroma/web/activity_pub/mrf/normalize_markup_test.exs @@ -15,6 +15,8 @@ defmodule Pleroma.Web.ActivityPub.MRF.NormalizeMarkupTest do this is a link with not allowed "rel" attribute: example.com this is an image:
+
mean
+ """ @expected """ @@ -25,6 +27,8 @@ defmodule Pleroma.Web.ActivityPub.MRF.NormalizeMarkupTest do this is a link with not allowed "rel" attribute: example.com this is an image:
alert('hacked') + mean + """ test "it filter html tags" do