Skip to content

Commit b6b63a7

Browse files
committed
Removed base, embed, input, link and source tags as "unsafe" tags
These are all void tags in HTML, meaning they do not have inner content. Fixes issue #1247
1 parent f0df54b commit b6b63a7

1 file changed

Lines changed: 0 additions & 5 deletions

File tree

MimeKit/Text/HtmlToHtml.cs

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -263,18 +263,13 @@ static bool IsUnsafe (HtmlTagId id)
263263
case HtmlTagId.Unknown: // Unknown tags could potentially be dangerous
264264
case HtmlTagId.Applet: // Can execute Java applets
265265
case HtmlTagId.Audio: // Can embed audio with potentially malicious content
266-
case HtmlTagId.Base: // Can hijack relative URLs
267-
case HtmlTagId.Embed: // Can embed executable content
268266
case HtmlTagId.Form: // Can submit data to an attacker's server
269267
case HtmlTagId.Frame: // Embeds external (and thus unsafe) content
270268
case HtmlTagId.FrameSet: // Container for frames
271269
case HtmlTagId.IFrame: // Embeds external (and thus unsafe) content
272-
case HtmlTagId.Input: // Can be used to steal user input or trigger actions
273-
case HtmlTagId.Link: // Can load external stylesheets that execute in certain contexts
274270
case HtmlTagId.Object: // Can embed executable content
275271
case HtmlTagId.Script: // Direct script execution
276272
case HtmlTagId.Select: // Can be used to steal user input or trigger actions
277-
case HtmlTagId.Source: // Can be used to define alternative audio or video sources
278273
case HtmlTagId.Style: // Can contain CSS with expression() or import of malicious content
279274
case HtmlTagId.TextArea: // Can be used to steal user input or trigger actions
280275
case HtmlTagId.Video: // Can embed video with potentially malicious content

0 commit comments

Comments
 (0)