Hi fellow RSS Reader authors (doesn't everybody write one these days?),
I came across this article about CSS-related vulnerabilities in email readers:
https://portswigger.net/research/css-the-bomb-inside-your-inbox
Frankly, I found this quite shocking. As RSS readers render third-party HTML, these issues potentially affect RSS readers as well.
I am wondering which strategies you use for sanitizing and rendering third-party HTML? In particular, for HTML-based readers.
In my reader, I am currently using whitelist-based sanitation of the HTML on the server side (using sanitize-html npm). On the client, I am using safeSetHTML where supported as a second-layer defense, but slightly less strict to avoid issues with third-party embeddings (TikTok, X..). Without safeSetHTML, I am using DOMPurify.
Unfortunately, my UI does not allow me to use iframes for HTML, which would allow additional sandboxing. CSP is still on my TODO list.
How do you deal with untrusted HTML?
submitted by /u/Odd-Anteater875