aljaz/CTFd
1
0
Fork 0
mirror of https://github.com/aljazceru/CTFd.git synced 2025-12-17 14:04:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Allow bootstrap data attributes through the HTML sanitizer (#1553)

Browse Source 
* Allow bootstrap data attributes through the HTML sanitizer
This commit is contained in:
Kevin Chung
2020-07-19 17:19:33 -04:00
committed by GitHub
parent e5d6d8b36c
commit 421dfc169a
1 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
CTFd/utils/security/sanitize.py
View File

@@ -12,7 +12,41 @@ cleaner = Cleaner(
links=False,
meta=False,
style=False,
safe_attrs=(safe_attrs | set(["style"])),
safe_attrs=(
safe_attrs
| set(
[
"style",
# Allow data attributes from bootstrap elements
"data-toggle",
"data-target",
"data-dismiss",
"data-spy",
"data-offset",
"data-html",
"data-placement",
"data-parent",
"data-title",
"data-template",
"data-interval",
"data-keyboard",
"data-pause",
"data-ride",
"data-wrap",
"data-touch",
"data-flip",
"data-boundary",
"data-reference",
"data-display",
"data-animation",
"data-container",
"data-delay",
"data-selector",
"data-content",
"data-trigger",
]
)
),
annoying_tags=False,
)