Whitelist rel values - #224
Conversation
notriddle
left a comment
notriddle
left a comment
There was a problem hiding this comment.
What are you specifically trying to accomplish here? Is there just one rel attribute you want to allow sometimes?
If so, I would consider using an implementation closer to our handling of class instead of trying to pull in the full IANA list off the web at build time.
| let html = client | ||
| .get(LINK_RELATIONS_PAGE) | ||
| .header( | ||
| reqwest::header::USER_AGENT, | ||
| "Mozilla/5.0 (compatible; CopilotBot/1.0)", | ||
| ) | ||
| .send() | ||
| .expect("Failed to fetch page") | ||
| .text() | ||
| .expect("Failed to read response text"); |
There was a problem hiding this comment.
We can't do that. This would break ammonia in build environments like docs.rs that don't have internet access.
| static VALID_RELS: LazyLock<HashSet<&'static str>> = LazyLock::new(|| { | ||
| include_str!(concat!( | ||
| env!("CARGO_MANIFEST_DIR"), | ||
| "/src/whitelists/rel.txt" | ||
| )) | ||
| .lines() | ||
| .map(str::trim) | ||
| .filter(|s| !s.is_empty()) | ||
| .collect() | ||
| }); |
There was a problem hiding this comment.
Many of the IANA-registered rel attributes are not safe (for example, canonical would allow hijacking your search results). You can't just allow all of them; you need to go through each one, make sure it's appropriate to your use case, and only allow the ones that are.
There was a problem hiding this comment.
The ones that seem legit are at least nofollow and the new ones ugc and sponsored. However, I don't know the exact list of valid rel values.
There was a problem hiding this comment.
I asked ChatGPT and it gave me this list, what do you think?
| Value | Description |
|---|---|
alternate |
Link to an alternate version of the document (e.g., print, translation) |
author |
Link to the author of the document |
bookmark |
Permanent bookmarkable link |
external |
Link to an external site |
help |
Link to a help document |
license |
Link to copyright or licensing information |
next |
Next document in a sequence |
nofollow |
Tells search engines not to follow the link (often used for paid links) |
noopener |
Prevents the new page from accessing window.opener (security measure) |
noreferrer |
Prevents sending the HTTP referrer header |
prefetch |
Suggests the browser should prefetch the linked resource |
prev |
Previous document in a sequence |
search |
Link to a search tool for the document |
tag |
Specifies that the link is a tag (often used in blogs) |
ugc |
User Generated Content — used for links in comments, forums, etc. |
sponsored |
Paid or promotional link — used for affiliate or ad links |
There was a problem hiding this comment.
rel = "me" (similar to author, "a resource about the author of the link's context" i.e. "this is also me" on profile page links) would be useful for pypa/readme_renderer#305, but I can see why it might not be desired for all use-cases.
3 participants
Closes #223