diff options
| author | Danilo M. <danix@danix.xyz> | 2026-09-15 18:15:50 +0200 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-09-15 18:15:50 +0200 |
| commit | 29886e00273127c228054e2b0097e12fe132c07f (patch) | |
| tree | 3df7ba587a91d5daa6198c31033daed40272c59a /docs/superpowers/specs/2026-09-15-notification-daemon-design.md | |
| parent | ea2c64c9a6fbc22bffbac4e2e57ce0762f5e03ad (diff) | |
| download | quickshell-29886e00273127c228054e2b0097e12fe132c07f.tar.gz quickshell-29886e00273127c228054e2b0097e12fe132c07f.zip | |
fix(notifications): allowlist local inline image sources
The http(s)-only regex let protocol-relative //host, ftp, data and
entity-encoded schemes through, and the comment overstated what it
removed. Replace it with a deny-by-default allowlist: an <img> is
removed unless its src, entities decoded first, is a file: URL or a
single leading slash. Protocol-relative //host is rejected while a
/absolute/path is kept.
Diffstat (limited to 'docs/superpowers/specs/2026-09-15-notification-daemon-design.md')
0 files changed, 0 insertions, 0 deletions