From 6e7a8c1ef646f30c4b09d0f6414e6ee0155a0913 Mon Sep 17 00:00:00 2001
From: Athou <jeremiepanzer@gmail.com>
Date: Tue, 13 Oct 2026 13:22:46 +0200
Subject: [PATCH] harden iframe protocols just in case

---
 .../backend/service/FeedEntryContentCleaningService.java      | 1 +
 .../backend/service/FeedEntryContentCleaningServiceTest.java  | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/commafeed-server/src/main/java/com/commafeed/backend/service/FeedEntryContentCleaningService.java b/commafeed-server/src/main/java/com/commafeed/backend/service/FeedEntryContentCleaningService.java
index eaf83849..6f04e7ab 100644
--- a/commafeed-server/src/main/java/com/commafeed/backend/service/FeedEntryContentCleaningService.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/service/FeedEntryContentCleaningService.java
@@ -148,6 +148,7 @@ public class FeedEntryContentCleaningService {
 
         whitelist.addProtocols("a", "href", "ftp", "http", "https", "magnet", "mailto");
         whitelist.addProtocols("blockquote", "cite", "http", "https");
+        whitelist.addProtocols("iframe", "src", "http", "https");
         whitelist.addProtocols("img", "src", "http", "https");
         whitelist.addProtocols("q", "cite", "http", "https");
 
diff --git a/commafeed-server/src/test/java/com/commafeed/backend/service/FeedEntryContentCleaningServiceTest.java b/commafeed-server/src/test/java/com/commafeed/backend/service/FeedEntryContentCleaningServiceTest.java
index fbd9aea7..82515921 100644
--- a/commafeed-server/src/test/java/com/commafeed/backend/service/FeedEntryContentCleaningServiceTest.java
+++ b/commafeed-server/src/test/java/com/commafeed/backend/service/FeedEntryContentCleaningServiceTest.java
@@ -15,7 +15,7 @@ class FeedEntryContentCleaningServiceTest {
 				<p>
 				Some text
 				<img width="965" height="320" src="https://localhost/an-image.png" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="alt-desc" decoding="async" sizes="(max-width: 965px) 100vw, 965px" style="width: 100%; opacity: 0">
-				<iframe src="url" style="width: 100%; opacity: 0"></iframe>
+				<iframe src="https://localhost/an-iframe" style="width: 100%; opacity: 0"></iframe>
 				<forbidden-element>aaa</forbidden-element>
 				""";
         String result = feedEntryContentCleaningService.clean(content, "baseUri", false);
@@ -25,7 +25,7 @@ class FeedEntryContentCleaningServiceTest {
 				<p>
 				Some text
 				<img width="965" height="320" src="https://localhost/an-image.png" alt="alt-desc" style="width:100%;">
-				<iframe src="url" style="width:100%;"></iframe>
+				<iframe src="https://localhost/an-iframe" style="width:100%;"></iframe>
 				aaa
 				</p>
 				"""