Overview - Ghost

Ghost

7 days30 days

Latest CI Pipeline Executions

Fuzzy

Succeeded
29483
7122bb08 Improved comments
by Sag
Succeeded
29483
7d290e60 Improved comments
by Sag
Succeeded
29483
bc08a17c Added client-side sanitization to the ActivityPub reader The reader injected remote ActivityPub article HTML into a script-executing, unsandboxed srcdoc iframe with only link-protocol filtering, so it relied entirely on the backend sanitize-html pass at ingestion. Every other remote-content surface in the app already had a second DOMPurify layer; a single permissive server-side sanitizer as the sole XSS control is fragile against sanitizer bypasses or legacy unsanitized rows. The new sanitizeArticleContent uses DOMPurify defaults with targeted overrides mirroring the backend rules rather than recreating them: iframes stay allowed for YouTube-style embeds, and scripts are only kept when loaded via https from platform.twitter.com / platform.x.com (with inline code stripped) so Twitter embeds keep working. It runs on a dedicated DOMPurify instance so the looser rules can't leak into the default sanitizer used by the feed, and with FORCE_BODY so articles that start with an embed script don't silently lose it to head hoisting.
by Sag