diff --git a/reader/sanitizer/sanitizer.go b/reader/sanitizer/sanitizer.go
index 2a0a2af3..f13681b3 100644
--- a/reader/sanitizer/sanitizer.go
+++ b/reader/sanitizer/sanitizer.go
@@ -131,15 +131,16 @@ func sanitizeAttributes(baseURL, tagName string, attributes []html.Attribute) ([
}
func getExtraAttributes(tagName string) ([]string, []string) {
- if tagName == "a" {
+ switch tagName {
+ case "a":
return []string{"rel", "target", "referrerpolicy"}, []string{`rel="noopener noreferrer"`, `target="_blank"`, `referrerpolicy="no-referrer"`}
- }
-
- if tagName == "video" || tagName == "audio" {
+ case "video", "audio":
return []string{"controls"}, []string{"controls"}
+ case "iframe":
+ return []string{"sandbox"}, []string{`sandbox="allow-scripts allow-same-origin"`}
+ default:
+ return nil, nil
}
-
- return nil, nil
}
func isValidTag(tagName string) bool {
diff --git a/reader/sanitizer/sanitizer_test.go b/reader/sanitizer/sanitizer_test.go
index 374c107c..fab493a0 100644
--- a/reader/sanitizer/sanitizer_test.go
+++ b/reader/sanitizer/sanitizer_test.go
@@ -165,7 +165,7 @@ func TestEspaceAttributes(t *testing.T) {
func TestReplaceYoutubeURL(t *testing.T) {
input := ``
- expected := ``
+ expected := ``
output := Sanitize("http://example.org/", input)
if expected != output {
@@ -175,7 +175,7 @@ func TestReplaceYoutubeURL(t *testing.T) {
func TestReplaceSecureYoutubeURL(t *testing.T) {
input := ``
- expected := ``
+ expected := ``
output := Sanitize("http://example.org/", input)
if expected != output {
@@ -185,7 +185,7 @@ func TestReplaceSecureYoutubeURL(t *testing.T) {
func TestReplaceSecureYoutubeURLWithParameters(t *testing.T) {
input := ``
- expected := ``
+ expected := ``
output := Sanitize("http://example.org/", input)
if expected != output {
@@ -194,8 +194,8 @@ func TestReplaceSecureYoutubeURLWithParameters(t *testing.T) {
}
func TestReplaceYoutubeURLAlreadyReplaced(t *testing.T) {
- input := ``
- expected := ``
+ input := ``
+ expected := ``
output := Sanitize("http://example.org/", input)
if expected != output {
@@ -205,7 +205,7 @@ func TestReplaceYoutubeURLAlreadyReplaced(t *testing.T) {
func TestReplaceIframeURL(t *testing.T) {
input := ``
- expected := ``
+ expected := ``
output := Sanitize("http://example.org/", input)
if expected != output {