fixing some security shit

This commit is contained in:
agnesthealien 2026-04-03 18:01:14 -04:00
parent 17af596c34
commit e96c08cdf5

View file

@ -142,7 +142,9 @@ module HtmlCleaner
# strip img tags, optionally leaving the HTML attributes (e.g. src and alt) exposed # strip img tags, optionally leaving the HTML attributes (e.g. src and alt) exposed
def strip_images(value, keep_src: false) def strip_images(value, keep_src: false)
value.gsub(%r{(?:<(img .*?) ?/?>)}, keep_src ? "\\1" : "") value.gsub(%r{(?:<(img .*?) ?/?>)}) do
keep_src ? Sanitize.clean(Regexp.last_match(1)) : ""
end
end end
def strip_html_breaks_simple(value) def strip_html_breaks_simple(value)