- Issue created by @henokmikre
- Status changed to Postponed: needs info
5 months ago 2:23pm 17 June 2024 - π«π·France fgm Paris, France
Not strictly against doing this, but it raises a number of security issues around escaping content which is an an unknown parsing context instead of being only in restricted attributes on specific elements.
Do you have a plan about how to it safely ? Consider that URLs may happen in text nodes, in HTML comments, in CDATA or PCDATA, in embedded JS, in CSS, etc. And all of those have different parsing rules.
I'm not convinced this can be done safely in all these contexts while maintaining a reasonable complexity level.
Alternatively, we might want to enable specific opt-in contexts, say for example the
src
attribute onlink
elements within the pagehead
. Would this be appropriate for you ? If so, do you think you could imagine a UI for this ? Just a wireframe would be enough since we use the admin theme anyway. I'm not good at UI design at all.Also, I think this could be at the global level, possibly overridable per-format, as envisioned on β¨ Need for global settings - reduce Postponed: needs info