Differential D363
Sanitize HTML in EventView Authored by tusooa on Mon, Sep 7, 5:42 PM.
Details
We introduce lexbor to sanitize HTML displayed in EventView. Qt's rich text display already filters out some of the most dangerous HTML, but <img> is still kept as-is. However, the Matrix spec says we should only accept src that is an mxc:// uri. Also added a benchmark to test its performance. Depends on: https://r.lily-is.land/the-kazv-project/libkazv-deps/pulls/2 Type: add Check you are able to view events just as before.
Diff Detail
Event TimelineComment Actions The overhead for sanitizing is really small, we can do ~50 in 1ms, so I do not think we need a cache unless something else warrants it. ] ./bin/kazv-sanitizer-benchmark-test
********* Start testing of KazvSanitizerBenchmarkTest *********
Config: Using QtTest library 6.11.2, Qt 6.11.2 (x86_64-little_endian-lp64 shared (dynamic) release build; by GCC 15.3.0), 'gentoo' '2.18'
PASS : KazvSanitizerBenchmarkTest::initTestCase()
PASS : KazvSanitizerBenchmarkTest::testSanitize()
RESULT : KazvSanitizerBenchmarkTest::testSanitize():
0.023 msecs per iteration (total: 96, iterations: 4096)
PASS : KazvSanitizerBenchmarkTest::testSanitizeQString()
RESULT : KazvSanitizerBenchmarkTest::testSanitizeQString():
0.0244 msecs per iteration (total: 100, iterations: 4096)
PASS : KazvSanitizerBenchmarkTest::cleanupTestCase()
Totals: 4 passed, 0 failed, 0 skipped, 0 blacklisted, 620ms
********* Finished testing of KazvSanitizerBenchmarkTest ********* |