HTML tags in repository description #1122

New issue

haydenwu · 2023-08-03T10:33:39+02:00

haydenwu commented

2023-08-03 10:33:39 +02:00

Many HTML tags are unnecessarily supported in repository description. Check https://codeberg.org/Peaksol/html_tags_test to see how rich the description text could be.

I guess it's okay to support a limited number of HTML tags, such as <a> for external links, and <img> for some little shields like "No GitHub".

The description is also shown on the personal profile page (https://codeberg.org/Peaksol), so you can see what a disaster it would be if all the HTML tags work.

Additionally, the page title for repos with rich text description is problematic. You can hover on the browser tab to see all those HTML tags in a mess. Guess it's also not good for SEO and stuff.

Many HTML tags are unnecessarily supported in repository description. Check https://codeberg.org/Peaksol/html_tags_test to see how rich the description text could be. I guess it's okay to support a limited number of HTML tags, such as `<a>` for external links, and `<img>` for some little shields like "No GitHub". The description is also shown on the personal profile page (https://codeberg.org/Peaksol), so you can see what a disaster it would be if all the HTML tags work. Additionally, the page title for repos with rich text description is problematic. You can hover on the browser tab to see all those HTML tags in a mess. Guess it's also not good for SEO and stuff.

👍 3

fnetX commented

2023-08-03 16:06:56 +02:00

Oh wow … I think we reported it already, and my example broke (but I think I was using markdown formatting not HTML). Looks like the markdown formatting was removed, but HTML still works?

fnetX added the

bug

contributions welcome

security

labels

2023-08-03 16:07:07 +02:00

n0toose added the

s/Forgejo

label

2023-08-06 13:21:33 +02:00

n0toose commented

2023-08-06 13:21:57 +02:00

and for some little shields like "No GitHub".

This could be a problem, we have many of those repositories that those little neat badges that just work - if images are banned, then those shields would be banned as well!

> and <img> for some little shields like "No GitHub". This could be a problem, we have many of those repositories that those little neat badges that just work - if images are banned, then those shields would be banned as well!

👍 1

caesar referenced this issue from forgejo/forgejo

2023-08-06 13:58:53 +02:00

[BUG] HTML tags in repository description #1202

caesar commented

2023-08-06 14:09:37 +02:00

Oh wow, this isn't nice.

Upstream issue: forgejo/forgejo#1202

This could be a problem, we have many of those repositories that those little neat badges that just work - if images are banned, then those shields would be banned as well!

To be honest I don't think they should be allowed in the repo description. The Readme is the place for that. But if we did want them I guess one way to somewhat limit the impact of abuse would be to set a maximum size for the description container with overflow: hidden.

My preference would be to allow basic markdown (bold, italic, and links) and nothing else.

Oh wow, this isn't nice. Upstream issue: https://codeberg.org/forgejo/forgejo/issues/1202 > This could be a problem, we have many of those repositories that those little neat badges that just work - if images are banned, then those shields would be banned as well! To be honest I don't think they should be allowed in the repo description. The Readme is the place for that. But if we did want them I guess one way to somewhat limit the impact of abuse would be to set a maximum size for the description container with `overflow: hidden`. My preference would be to allow basic markdown (bold, italic, and links) and nothing else.

👍 1

fnetX commented

2023-08-06 18:32:39 +02:00

Couldn't we technically also set a max-size on the image elements itself?

Gusted commented

2023-08-06 21:07:49 +02:00

Couldn't we technically also set a max-size on the image elements itself?

An post processer can be added for that.

> Couldn't we technically also set a max-size on the image elements itself? An post processer can be added for that.

caesar commented

2023-08-06 23:15:13 +02:00

I guess something like

div#repo-desc img {
  max-width: 5em !important;
  max-height: 2em !important;
}

might work. But an inline style with !important might still override it I think. Maybe we can filter !important out of inline styles though (if we allow them at all – see forgejo/forgejo#1183).

Alternatively we could do some post-processing as @Gusted suggest but it might be quite complex.

I guess something like ```css div#repo-desc img { max-width: 5em !important; max-height: 2em !important; } ``` might work. But an inline style with `!important` might still override it I think. Maybe we can filter `!important` out of inline styles though (if we allow them at all – see forgejo/forgejo#1183). Alternatively we could do some post-processing as @Gusted suggest but it might be quite complex.

Gusted referenced this issue from a commit

2023-09-13 12:07:02 +02:00

[GITEA] Use restrict sanitizer for description

Gusted referenced this issue from a commit

2023-09-13 12:10:44 +02:00

[GITEA] Use restricted sanitizer for repository description

Gusted referenced this issue from forgejo/forgejo

2023-09-13 12:10:51 +02:00

[GITEA] Use restricted sanitizer for repository description #1433

Gusted referenced this issue from a commit

2023-09-13 12:11:32 +02:00

[GITEA] Use restricted sanitizer for repository description