Allow img tag with src as data:image/png;base64

[dkaushik411]

I am converting a canvas to image to export in PDF from html. But HtmlSanitizeEx.Scrubber.Meta.allow_tag_with_uri_attributes(
"img",
["src"],
["http", "https", "mailto", "/", "data:image/png;base64"]
)

remove the src attribute from img tag.

[rrrene]

That is a bug 😞

Here is a workaround until I fix it:

defmodule MyScrubber do
  require HtmlSanitizeEx.Scrubber.Meta
  alias HtmlSanitizeEx.Scrubber.Meta

  Meta.remove_cdata_sections_before_scrub()
  Meta.strip_comments()
  
  Meta.allow_tag_with_these_attributes "img", []
  def scrub_attribute("img", {"src", "data:" <> _ = uri}) do
    {"src", uri}
  end
  Meta.allow_tag_with_uri_attributes(
      "img",
      ["src"],
      ["http", "https", "mailto", "data"]
    )

  Meta.strip_everything_not_covered()
end

~s|<img src="data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==" onload="malware()" />|
|> HtmlSanitizeEx.Scrubber.scrub(MyScrubber)

You have to add both statements:

  Meta.allow_tag_with_these_attributes "img", []
  def scrub_attribute("img", {"src", "data:" <> _ = uri}) do
    {"src", uri}
  end

before (!) the call to allow_tag_with_uri_attributes.

Sorry for the inconvenience. 🙏

[dkaushik411]

Thanks @rrrene the workaround did work. Please notify once it is fixed and available in project.