Skip to content

feat: extend <video> tag allowed attributes - #38279

Merged
bircni merged 4 commits into
go-gitea:mainfrom
80avin:patch-1
Jun 30, 2026
Merged

feat: extend <video> tag allowed attributes#38279
bircni merged 4 commits into
go-gitea:mainfrom
80avin:patch-1

Conversation

@80avin

@80avin 80avin commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

autoplay is useless nowadays without "muted" as browsers won't autoplay unmuted videos.
Similarly, other attributes are also commonly used and harmless to keep.

@80avin
feat: extend <video> tag allowed attributes
d6ca613 
autoplay is useless nowadays without "muted" as browsers won't autoplay unmuted videos.
Similarly, other attributes are also commonly used and harmless to keep.

Signed-off-by: Avinash Thakur <19588421+80avin@users.noreply.github.com>
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jun 30, 2026
@github-actions github-actions Bot added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label Jun 30, 2026
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jun 30, 2026
@silverwind
silverwind requested a review from Copilot June 30, 2026 17:16
Copilot AI reviewed Jun 30, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Extends the default HTML sanitizer policy to permit additional commonly used <video> attributes (notably muted, enabling practical autoplay usage) while keeping the existing URL-scheme restrictions and general sanitization behavior.

Changes:

  • Expand the <video>-specific allowed attribute list to include muted, loop, and playsinline.
  • Add width/height to the <video> allowlist (note: these appear to already be globally allowed via generalSafeAttrs).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread modules/markup/sanitizer_default.go Outdated
Comment thread modules/markup/sanitizer_default.go Outdated
@silverwind
silverwind self-requested a review June 30, 2026 17:19
@GiteaBot GiteaBot added lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jun 30, 2026
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jun 30, 2026
@lunny lunny added this to the 1.28.0 milestone Jun 30, 2026
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jun 30, 2026
@bircni
bircni enabled auto-merge (squash) June 30, 2026 19:48
@bircni bircni added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Jun 30, 2026
@bircni
bircni merged commit 7745720 into go-gitea:main Jun 30, 2026
23 checks passed
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Jun 30, 2026
@80avin
80avin deleted the patch-1 branch July 1, 2026 01:58
@wxiaoguang

wxiaoguang commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

@bircni

Why keep garbage in commit message?

image

zjjhot added a commit to zjjhot/gitea that referenced this pull request Jul 4, 2026
@zjjhot
Merge branch 'main' of https://github.com/go-gitea/gitea
ce04f77 
* 'main' of https://github.com/go-gitea/gitea: (24 commits)
  [skip ci] Updated translations via Crowdin
  fix(actions): make runner list pagination order deterministic (go-gitea#38313)
  fix(release): gate draft release attachments on web download endpoints (go-gitea#38318)
  ci(snap): build snaps natively instead of on launchpad (go-gitea#38312)
  chore: update `eslint-plugin-unicorn` to v70 (go-gitea#38310)
  feat(webhook): support Telegram Bot API 10.1 Rich Messages (go-gitea#38298)
  chore(snap): drop `armhf` build (go-gitea#38311)
  fix(actions): prevent chevron overlap with log text when timestamps are enabled (go-gitea#38227)
  chore: upgrade `go-swagger` to v0.35.0 and enforce zero swagger warnings (go-gitea#38299)
  fix: Improve since/until when counting commits for X-Total-Count (go-gitea#38243)
  chore: remove eslint-plugin-array-func (go-gitea#38294)
  docs: Welcome Zettat to TOC (go-gitea#38303)
  fix(workflows): branch protection status checks fail when workflow uses on: paths filter (go-gitea#38237)
  chore: update node.js to v26 (go-gitea#38285)
  refactor: replace `vue-bar-graph` dependency with inlined SVG chart (go-gitea#38292)
  feat(auth): add `disable-2fa` command (go-gitea#38275)
  fix(oauth2): persist linkAccountData during auto-link 2FA flow (go-gitea#38274)
  fix(actions): allow Actions bot to push to protected branches (go-gitea#38284)
  [skip ci] Updated translations via Crowdin
  feat: extend <video> tag allowed attributes (go-gitea#38279)
  ...
zjjhot added a commit to zjjhot/gitea that referenced this pull request Jul 4, 2026
@zjjhot
Merge branch 'main' into mainzjj
87f4c6c 
* main: (24 commits)
  [skip ci] Updated translations via Crowdin
  fix(actions): make runner list pagination order deterministic (go-gitea#38313)
  fix(release): gate draft release attachments on web download endpoints (go-gitea#38318)
  ci(snap): build snaps natively instead of on launchpad (go-gitea#38312)
  chore: update `eslint-plugin-unicorn` to v70 (go-gitea#38310)
  feat(webhook): support Telegram Bot API 10.1 Rich Messages (go-gitea#38298)
  chore(snap): drop `armhf` build (go-gitea#38311)
  fix(actions): prevent chevron overlap with log text when timestamps are enabled (go-gitea#38227)
  chore: upgrade `go-swagger` to v0.35.0 and enforce zero swagger warnings (go-gitea#38299)
  fix: Improve since/until when counting commits for X-Total-Count (go-gitea#38243)
  chore: remove eslint-plugin-array-func (go-gitea#38294)
  docs: Welcome Zettat to TOC (go-gitea#38303)
  fix(workflows): branch protection status checks fail when workflow uses on: paths filter (go-gitea#38237)
  chore: update node.js to v26 (go-gitea#38285)
  refactor: replace `vue-bar-graph` dependency with inlined SVG chart (go-gitea#38292)
  feat(auth): add `disable-2fa` command (go-gitea#38275)
  fix(oauth2): persist linkAccountData during auto-link 2FA flow (go-gitea#38274)
  fix(actions): allow Actions bot to push to protected branches (go-gitea#38284)
  [skip ci] Updated translations via Crowdin
  feat: extend <video> tag allowed attributes (go-gitea#38279)
  ...
zeekay pushed a commit to hanzoai/git that referenced this pull request Jul 26, 2026
@80avin
feat: extend <video> tag allowed attributes (go-gitea#38279)
63da042 
autoplay is useless nowadays without "muted" as browsers won't autoplay
unmuted videos.
Similarly, other attributes are also commonly used and harmless to keep.

<!--
Before submitting:
- Target the `main` branch; release branches are for backports only.
- Use a Conventional Commits title, e.g. `fix(repo): handle empty branch
names`.
- Read the contributing guidelines:
https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md
- Documentation changes go to https://gitea.com/gitea/docs

Describe your change below and link any issue it fixes.
-->

---------

Signed-off-by: Avinash Thakur <19588421+80avin@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@lunny lunny lunny approved these changes
@delvh delvh delvh approved these changes
@silverwind silverwind Awaiting requested review from silverwind

Assignees

No one assigned

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/feature Completely new functionality. Can only be merged if feature freeze is not active.

Projects

None yet

Milestone

28.0.0

Development

Successfully merging this pull request may close these issues.

8 participants

@80avin @wxiaoguang @lunny @silverwind @delvh @GiteaBot @bircni