Added: allowed iframes in docs (#372)

signebedi · Oct 27, 2024 · 6abbd12 · 6abbd12
1 parent 7bbe6df
commit 6abbd12
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/libreforms_fastapi/utils/docs.py b/libreforms_fastapi/utils/docs.py
@@ -10,16 +10,17 @@
 from html_sanitizer import Sanitizer
 
 sanitizer_config = {
-    'tags': {'a', 'br', 'p', 'strong', 'em', 'ul', 'ol', 'li', 'b', 'i', 'u', 'span', 'div', 'img', 'h1', 'h2', 'h3', 'h4', 'h5'},
+    'tags': {'a', 'br', 'p', 'strong', 'em', 'ul', 'ol', 'li', 'b', 'i', 'u', 'span', 'div', 'img', 'h1', 'h2', 'h3', 'h4', 'h5', 'iframe'},
     'attributes': {
         'a': ['href', 'title'],
         'img': ['src', 'alt'], 
         'div': ['style', 'class'],  # Might make sense to sanitize style content separately
         'p': ['style', 'class'],  # Might make sense to sanitize style content separately
+        'iframe': ['src', 'width', 'height', 'frameborder', 'allowfullscreen'],
     },
     'empty': {'br', 'h1', 'h2', 'h3', 'h4', 'h5'},
-    'separate': {'a', 'p', 'ul', 'ol', 'li', 'br', 'img'}, 
-    'protocols': {'a': ['http', 'https', 'mailto'], 'img': ['http', 'https']},
+    'separate': {'a', 'p', 'ul', 'ol', 'li', 'br', 'img', 'iframe'}, 
+    'protocols': {'a': ['http', 'https', 'mailto'], 'img': ['http', 'https'], 'iframe': ['http', 'https']},
     'unescape_special_chars': True
 }