diff --git a/src/snek/service/channel_message.py b/src/snek/service/channel_message.py index 0579451..eefff96 100644 --- a/src/snek/service/channel_message.py +++ b/src/snek/service/channel_message.py @@ -67,6 +67,7 @@ class ChannelMessageService(BaseService): ) template = self.app.jinja2_env.get_template("message.html") model["html"] = template.render(**context) + model["html"] = whitelist_attributes(model["html"]) return await super().save(model) async def offset(self, channel_uid, page=0, timestamp=None, page_size=30): diff --git a/src/snek/system/template.py b/src/snek/system/template.py index 76af47f..896e5d9 100644 --- a/src/snek/system/template.py +++ b/src/snek/system/template.py @@ -130,7 +130,9 @@ def whitelist_attributes(html): soup = BeautifulSoup(html, 'html.parser') for tag in soup.find_all(): - if isinstance(tag, Tag): + if hasattr(tag, 'attrs'): + if tag.name == 'script': + tag.replace_with('') attrs = dict(tag.attrs) for attr in list(attrs): # Check if attribute is in the safe list or is a data-* attribute