diff --git a/internal/reader/sanitizer/sanitizer.go b/internal/reader/sanitizer/sanitizer.go index 047ca904..33c564de 100644 --- a/internal/reader/sanitizer/sanitizer.go +++ b/internal/reader/sanitizer/sanitizer.go @@ -18,71 +18,71 @@ import ( ) var ( - allowedHTMLTagsAndAttributes = map[string][]string{ - "a": {"href", "title", "id"}, - "abbr": {"title"}, - "acronym": {"title"}, + allowedHTMLTagsAndAttributes = map[string]map[string]struct{}{ + "a": {"href": {}, "title": {}, "id": {}}, + "abbr": {"title": {}}, + "acronym": {"title": {}}, "aside": {}, - "audio": {"src"}, + "audio": {"src": {}}, "blockquote": {}, "b": {}, "br": {}, "caption": {}, "cite": {}, "code": {}, - "dd": {"id"}, + "dd": {"id": {}}, "del": {}, "dfn": {}, - "dl": {"id"}, - "dt": {"id"}, + "dl": {"id": {}}, + "dt": {"id": {}}, "em": {}, "figcaption": {}, "figure": {}, - "h1": {"id"}, - "h2": {"id"}, - "h3": {"id"}, - "h4": {"id"}, - "h5": {"id"}, - "h6": {"id"}, + "h1": {"id": {}}, + "h2": {"id": {}}, + "h3": {"id": {}}, + "h4": {"id": {}}, + "h5": {"id": {}}, + "h6": {"id": {}}, "hr": {}, - "iframe": {"width", "height", "frameborder", "src", "allowfullscreen"}, - "img": {"alt", "title", "src", "srcset", "sizes", "width", "height", "fetchpriority", "decoding"}, + "iframe": {"width": {}, "height": {}, "frameborder": {}, "src": {}, "allowfullscreen": {}}, + "img": {"alt": {}, "title": {}, "src": {}, "srcset": {}, "sizes": {}, "width": {}, "height": {}, "fetchpriority": {}, "decoding": {}}, "ins": {}, "kbd": {}, - "li": {"id"}, - "ol": {"id"}, + "li": {"id": {}}, + "ol": {"id": {}}, "p": {}, "picture": {}, "pre": {}, - "q": {"cite"}, + "q": {"cite": {}}, "rp": {}, "rt": {}, "rtc": {}, "ruby": {}, "s": {}, "samp": {}, - "source": {"src", "type", "srcset", "sizes", "media"}, + "source": {"src": {}, "type": {}, "srcset": {}, "sizes": {}, "media": {}}, "strong": {}, "sub": {}, - "sup": {"id"}, + "sup": {"id": {}}, "table": {}, - "td": {"rowspan", "colspan"}, + "td": {"rowspan": {}, "colspan": {}}, "tfoot": {}, - "th": {"rowspan", "colspan"}, + "th": {"rowspan": {}, "colspan": {}}, "thead": {}, - "time": {"datetime"}, + "time": {"datetime": {}}, "tr": {}, "u": {}, - "ul": {"id"}, + "ul": {"id": {}}, "var": {}, - "video": {"poster", "height", "width", "src"}, + "video": {"poster": {}, "height": {}, "width": {}, "src": {}}, "wbr": {}, // MathML: https://w3c.github.io/mathml-core/ and https://developer.mozilla.org/en-US/docs/Web/MathML/Reference/Element "annotation": {}, "annotation-xml": {}, "maction": {}, - "math": {"xmlns"}, + "math": {"xmlns": {}}, "merror": {}, "mfrac": {}, "mi": {}, @@ -423,7 +423,8 @@ func isValidTag(tagName string) bool { func isValidAttribute(tagName, attributeName string) bool { if attributes, ok := allowedHTMLTagsAndAttributes[tagName]; ok { - return slices.Contains(attributes, attributeName) + _, allowed := attributes[attributeName] + return allowed } return false }