Unclickable links in RSS feeds since Dec 28, 2022 push to master tree

[Antorell]

Please complete the following tasks.

• Web browser cache cleared
• Link provided to install script if applicable
• Web browser, ruTorrent, PHP and OS version provided

Tell us about your environment

ruTorrent v4.0 beta (master Dec 28, 2022)
php 8.1
Ubuntu 22.10

Tell us how you installed ruTorrent

git clone from the master branch (Dec 28, 2022)

Describe the bug

Posting a bug report before I forget.

There's still an issue with the new RSS changes that were pushed to the master branch the Dec 28, 2022. The links in the description of the feeds are not clickable anymore. The links are colored like other links, or the links before the RSS changes, but they cannot be clicked. Feeds can be loaded without problems.

Happy new year.

Steps to reproduce

Load a RSS feed that has links to the release page or external links

Feed with links: https://feed.animetosho.org/rss2

Expected behavior

No response

Additional context

[stickz]

Hi @Antorell, this is intentional for security reasons. It could cause serious phishing implications if we don't disable links.

[Antorell]

Yes, the other day I didn't check the sanitize.config.js in the js/ folder and thought the RESTRICTED keyword at the end of sanitize.config in the init.js of the RSS plugin was fixed feature and not an option.

I switched RESTRICTED to BASIC in the init.js of the RSS plugin, and it works like before the sanitize changes. I also added a _blank parameter to add attribute so links open in a new tab.

   add_attributes: {
     'a': {
            'rel': 'nofollow',
	    'target': '_blank'   
          }
   },

Cheers

[Novik]

@Antorell
AFAIK, in this case 'nofollow' should be replaced with 'noreferrer noopener'.

[Antorell]

I will, thanks.