You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Background colours for messages would be a useful addition to the matrix web interface because some bridged systems support this functionality, namely IRC. This can be problematic when an IRC message is sent across which has white text and a black background. The text could become difficult to read when against the potentially light background of a matrix client.
A suggestion is to modify the HTML sanitation of <font> tags so that
whilst checking for CSS injection of the provided bg-color.
Given that CSS injection needs to be checked for anyway, perhaps a better solution would be to accept the style attribute and only allow color and background-color attributes to be allowed. http-sanitize sadly doesn't support this functionality, but it could be written separately.
Originally matrix-org/matrix-react-sdk#380; @lukebarnard1 says:
Background colours for messages would be a useful addition to the matrix web interface because some bridged systems support this functionality, namely IRC. This can be problematic when an IRC message is sent across which has white text and a black background. The text could become difficult to read when against the potentially light background of a matrix client.
A suggestion is to modify the HTML sanitation of
<font>
tags so thatis transformed into
whilst checking for CSS injection of the provided bg-color.
Given that CSS injection needs to be checked for anyway, perhaps a better solution would be to accept the
style
attribute and only allowcolor
andbackground-color
attributes to be allowed.http-sanitize
sadly doesn't support this functionality, but it could be written separately.Sanitization within matrix-react-sdk:
https://github.com/matrix-org/matrix-react-sdk/blob/24223ae2b69debb33fa22fcda5aeba6fa93c93eb/src/HtmlUtils.js
(See matrix-org/matrix-appservice-irc#62)
The text was updated successfully, but these errors were encountered: