From 4247cff2fa940d7dcc8b059e70b2b338183e3e8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Commaille?= <76261501+zecakeh@users.noreply.github.com> Date: Tue, 19 Mar 2024 22:51:59 +0100 Subject: [PATCH] Deprecate the `font` HTML tag (#1739) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Deprecate the `font` HTML tag Rationale: MSC4077 allows to deprecate HTML tags that are deprecated in the WHATWG standard, if they can be replaced by tags with the same feature. `font` is deprecated and can be replaced by `span` with the `data-mx-bg-color` and `data-mx-color` attributes. Signed-off-by: Kévin Commaille * Add changelog Signed-off-by: Kévin Commaille * Add deprecation info box Signed-off-by: Kévin Commaille --------- Signed-off-by: Kévin Commaille --- .../newsfragments/1739.clarification | 1 + .../modules/instant_messaging.md | 17 ++++++++++++----- 2 files changed, 13 insertions(+), 5 deletions(-) create mode 100644 changelogs/client_server/newsfragments/1739.clarification diff --git a/changelogs/client_server/newsfragments/1739.clarification b/changelogs/client_server/newsfragments/1739.clarification new file mode 100644 index 00000000..da43cefb --- /dev/null +++ b/changelogs/client_server/newsfragments/1739.clarification @@ -0,0 +1 @@ +The [font](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/font) element is deprecated in the HTML spec. Clients should prefer [span](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/span) with the `data-mx-bg-color` and `data-mx-color` attributes instead. \ No newline at end of file diff --git a/content/client-server-api/modules/instant_messaging.md b/content/client-server-api/modules/instant_messaging.md index fd05b74b..5f5f450f 100644 --- a/content/client-server-api/modules/instant_messaging.md +++ b/content/client-server-api/modules/instant_messaging.md @@ -43,10 +43,10 @@ were limited to `m.text`, `m.emote`, `m.notice`, and Clients should limit the HTML they render to avoid Cross-Site Scripting, HTML injection, and similar attacks. The strongly suggested set of HTML tags to permit, denying the use and rendering of anything else, is: -`font`, `del`, `h1`, `h2`, `h3`, `h4`, `h5`, `h6`, `blockquote`, `p`, -`a`, `ul`, `ol`, `sup`, `sub`, `li`, `b`, `i`, `u`, `strong`, `em`, -`s`, `code`, `hr`, `br`, `div`, `table`, `thead`, `tbody`, `tr`, -`th`, `td`, `caption`, `pre`, `span`, `img`, `details`, `summary`. +`del`, `h1`, `h2`, `h3`, `h4`, `h5`, `h6`, `blockquote`, `p`, `a`, `ul`, +`ol`, `sup`, `sub`, `li`, `b`, `i`, `u`, `strong`, `em`, `s`, `code`, +`hr`, `br`, `div`, `table`, `thead`, `tbody`, `tr`, `th`, `td`, +`caption`, `pre`, `span`, `img`, `details`, `summary`. {{% boxes/note %}} {{% added-in v="1.10" %}} @@ -55,6 +55,14 @@ requiring a [Spec Change Proposal](/proposals) when they are deprecated in the [WHATWG HTML Living Standard](https://html.spec.whatwg.org/multipage/). {{% /boxes/note %}} +{{% boxes/note %}} +{{% changed-in v="1.10" %}} +In previous versions of the specification, the `font` tag was suggested with the +`data-mx-bg-color`, `data-mx-color` and `color` attributes. This tag is now +deprecated in favor of the `span` tag with the `data-mx-bg-color` and +`data-mx-color` attributes in new messages. +{{% /boxes/note %}} + Not all attributes on those tags should be permitted as they may be avenues for other disruption attempts, such as adding `onclick` handlers or excessively large text. Clients should only permit the attributes @@ -65,7 +73,6 @@ the tag. | Tag | Permitted Attributes | |--------|--------------------------------------------------------------------------------------------------------------------------------------------| -| `font` | `data-mx-bg-color`, `data-mx-color`, `color` | | `span` | `data-mx-bg-color`, `data-mx-color`, `data-mx-spoiler` (see [spoiler messages](#spoiler-messages)) | | `a` | `name`, `target`, `href` (provided the value is not relative and has a scheme matching one of: `https`, `http`, `ftp`, `mailto`, `magnet`) | | `img` | `width`, `height`, `alt`, `title`, `src` (provided it is a [Matrix Content (`mxc://`) URI](#matrix-content-mxc-uris)) |