Closed
Description
Our readme renderer uses Ammonia to sanitise the HTML. We currently explicitly list all HTML tags and attributes we allow in the source code. To simplify this code, and to allow some additional safe attributes we currently don't allow, we could rely on Ammonia's defaults instead, and add any additional items we may need.
Suggested steps:
- Consider upgrading to the latest Ammonia release.
- Compare the list of currently allowed tags in crates.io to the defaults in Ammonia.
- Update the code to in
MarkdownRenderer::new()
(linked above) to only add these additional tags to the defaults.