URI.DisableExternalResources in conjunction with HTML.SafeIframe
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.4k
- Forks
- 361
- Avg merge
- 3d 41m
- Merged PRs (30d)
- 2
Description
Hi,
We're currently using HTML.SafeIframe (along with URI.SafeIframeRegexp) to allow/whitelist YouTube and Vimeo videos and everything works well.
That said, we now need to also allow <img> tags, and only for images hosted on our domain. We've tried using URI.DisableExternalResources with URI.Host set to our domain, which works on its own for images, but causes an issue for other kinds of external resources (e.g. iframes). Given that URI.Host is set to our domain and given that it only accepts one domain, restricting external resources to our domain means we disable Youtube/Video videos.
In other words, it does seem like URI.DisableExternalResources trumps HTML.SafeIframe, which means it's not possible to disable external images while also allowing iframes for Youtube.
Is there a workaround for that by any chance?
Thank you.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the URI.DisableExternalResources and URI.Host behavior alongside HTML.SafeIframe and URI.SafeIframeRegexp. Determine whether the existing policies can be composed so domain-hosted images remain allowed while YouTube and Vimeo iframes remain whitelisted. Done means the supported configuration or limitation is documented and covered by relevant tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100