Input Sanitization

In order not to spread scripts, vulnerabilities, and glitchy HTML all over the place, GoToSocial performs the following types of input sanitization:

plain input type:

• Before parsing, any existing HTML is completely removed from the post body and content-warning fields.
• After parsing, all generated HTML is run through a sanitizer to remove harmful elements.

markdown input type:

• Before parsing, any existing HTML is completely removed from the content-warning field.
• Before parsing, any existing HTML in the post body is run through a sanitizer to remove harmful elements.
• After parsing, all generated HTML is run through a sanitizer to remove harmful elements.