Allow more structured data script tag types #706
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To fix #46 a simple logic was applied to
SearchHTMLBody
to only allow script tags if they contained the stringapplication/ld+json
but there are other structured data scripts that are not harmful.One such script is
application/json+trustpilot
(see https://help.trustpilot.com/s/article/Add-a-structured-data-snippet-for-Automatic-Feedback-Service?language=en_US)I modified the logic to allow a more generic type pattern of
application/*+json
andapplication/json+*
. The code also looks for the stringtype="..."
as this prevents scripts like<script type="application/javascript" whatever="application/ld+json">
to bypass the filter.IMHO this would be better implemented as a configurable pattern, but as a simple alternative this should be flexible enough for now.
Another alternative would be to only block script tags where the
type
attribute is either missing or one ofapplication/javascript
ortext/javascript
since these are in theory the only potentially dangerous types. This would work better against a script written like this:<script type="application/javascript" type="application/ld+json">
which would still be included in the email.