Sanitize HTML in EventView
Needs ReviewPublic
Actions

Authored by tusooa on Mon, Sep 7, 5:42 PM.

Details

Reviewers

None

Group Reviewers

Summary

We introduce lexbor to sanitize HTML displayed in EventView. Qt's rich text display already filters out some of the most dangerous HTML, but <img> is still kept as-is. However, the Matrix spec says we should only accept src that is an mxc:// uri.

Also added a benchmark to test its performance.

Depends on: https://r.lily-is.land/the-kazv-project/libkazv-deps/pulls/2

Type: add

Test Plan

Check you are able to view events just as before.

Diff Detail

Repository

rK kazv

Branch

tusooa/stacked

Lint

No Lint Coverage

Unit

No Test Coverage

Build Status

Buildable 721
Build 1424: Invoke Buildbot	Buildbot build #2662
Build 1423: arc lint + arc unit

Event Timeline

tusooa created this revision.Mon, Sep 7, 5:42 PM

Owners added a reviewer: O1: the Kazv Project.Mon, Sep 7, 5:42 PM

Harbormaster returned this revision to the author for changes because remote builds failed.Mon, Sep 7, 5:51 PM

Harbormaster failed remote builds in B720: Diff 1113!

tusooa requested review of this revision.Mon, Sep 7, 5:52 PM

TODO: add lexbor to README and flatpak manifest

The overhead for sanitizing is really small, we can do ~50 in 1ms, so I do not think we need a cache unless something else warrants it.

] ./bin/kazv-sanitizer-benchmark-test
********* Start testing of KazvSanitizerBenchmarkTest *********
Config: Using QtTest library 6.11.2, Qt 6.11.2 (x86_64-little_endian-lp64 shared (dynamic) release build; by GCC 15.3.0), 'gentoo' '2.18'
PASS   : KazvSanitizerBenchmarkTest::initTestCase()
PASS   : KazvSanitizerBenchmarkTest::testSanitize()
RESULT : KazvSanitizerBenchmarkTest::testSanitize():
     0.023 msecs per iteration (total: 96, iterations: 4096)
PASS   : KazvSanitizerBenchmarkTest::testSanitizeQString()
RESULT : KazvSanitizerBenchmarkTest::testSanitizeQString():
     0.0244 msecs per iteration (total: 100, iterations: 4096)
PASS   : KazvSanitizerBenchmarkTest::cleanupTestCase()
Totals: 4 passed, 0 failed, 0 skipped, 0 blacklisted, 620ms
********* Finished testing of KazvSanitizerBenchmarkTest *********