Differential D363

Sanitize HTML in EventView
ClosedPublic
Actions

Authored by tusooa on Mon, Sep 7, 5:42 PM.

Details

Reviewers

nannanko

Group Reviewers

O1: the Kazv Project

Commits

rK9cc311ce4336: Sanitize HTML in EventView

Summary

We introduce lexbor to sanitize HTML displayed in EventView. Qt's rich text display already filters out some of the most dangerous HTML, but <img> is still kept as-is. However, the Matrix spec says we should only accept src that is an mxc:// uri.

Also added a benchmark to test its performance.

Depends on: https://r.lily-is.land/the-kazv-project/libkazv-deps/pulls/2

Type: add

Test Plan

Check you are able to view events just as before.

Diff Detail

Repository

rK kazv

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

tusooa created this revision.Mon, Sep 7, 5:42 PM

Owners added a reviewer: O1: the Kazv Project.Mon, Sep 7, 5:42 PM

Harbormaster returned this revision to the author for changes because remote builds failed.Mon, Sep 7, 5:51 PM

Harbormaster failed remote builds in B720: Diff 1113!

tusooa requested review of this revision.Mon, Sep 7, 5:52 PM

TODO: add lexbor to README and flatpak manifest

The overhead for sanitizing is really small, we can do ~50 in 1ms, so I do not think we need a cache unless something else warrants it.

] ./bin/kazv-sanitizer-benchmark-test
********* Start testing of KazvSanitizerBenchmarkTest *********
Config: Using QtTest library 6.11.2, Qt 6.11.2 (x86_64-little_endian-lp64 shared (dynamic) release build; by GCC 15.3.0), 'gentoo' '2.18'
PASS   : KazvSanitizerBenchmarkTest::initTestCase()
PASS   : KazvSanitizerBenchmarkTest::testSanitize()
RESULT : KazvSanitizerBenchmarkTest::testSanitize():
     0.023 msecs per iteration (total: 96, iterations: 4096)
PASS   : KazvSanitizerBenchmarkTest::testSanitizeQString()
RESULT : KazvSanitizerBenchmarkTest::testSanitizeQString():
     0.0244 msecs per iteration (total: 100, iterations: 4096)
PASS   : KazvSanitizerBenchmarkTest::cleanupTestCase()
Totals: 4 passed, 0 failed, 0 skipped, 0 blacklisted, 620ms
********* Finished testing of KazvSanitizerBenchmarkTest *********