From adc83b8a0b7db59185e82dc4da0d9ded2ff43efe Mon Sep 17 00:00:00 2001
From: Salastil <salastil@cock.li>
Date: Wed, 9 Sep 2026 18:30:49 -0400
Subject: [PATCH] Write down what the sanitiser was accused of, and cleared of

#142 suspected that parsing a message's HTML fetched the things it named -
remote stylesheets and fonts, seen as blocked requests while switching
conversations. It does not. A body carrying a stylesheet link, an @font-face,
an https image, a CSS url() and a script src was parsed through this exact
path with the network watched: nothing was requested, and no policy was
violated. The document really is inert.

So the comment saying so now says it was measured, and points at where the
real reach is: `safeImageSrc` passes any https image straight through to a
rendered <img>, which is what makes inline images and custom emoji work and
also what lets a sender learn their message was read. That is #145, and a
decision rather than a fix.

The blocked requests that started this remain unattributed. They were real -
captured twice - but they are not the sanitiser's, they are not in any stored
message, and a full reload plus a walk through every account produces none.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/renderer/src/lib/richtext.tsx | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/renderer/src/lib/richtext.tsx b/src/renderer/src/lib/richtext.tsx
index b32d607..70866bc 100644
--- a/src/renderer/src/lib/richtext.tsx
+++ b/src/renderer/src/lib/richtext.tsx
@@ -121,6 +121,16 @@ interface Handlers {
 export function RichText({ html, onRevealSpoiler, onOpenChannel, onOpenLink }: RichTextProps): JSX.Element {
   // DOMParser builds an inert document: no scripts run, no images load, no
   // network requests happen during parsing.
+  //
+  // Measured rather than assumed, because it was once doubted (#142): a body
+  // carrying `<link rel=stylesheet>`, `<style>@font-face`, `<img src=https:>`,
+  // a CSS `background: url()` and a `<script src>` was parsed here with the
+  // network watched, and not one of the five was fetched. The parse is safe;
+  // what a message can reach for, it reaches for when something *renders*.
+  //
+  // Which is a live surface rather than a theoretical one: `safeImageSrc`
+  // below passes any https image through, so a formatted body can name a URL
+  // its author controls and learn that the message was read - see #145.
   const doc = new DOMParser().parseFromString(`<body>${html}</body>`, 'text/html')
   return <>{walk(doc.body, { onRevealSpoiler, onOpenChannel, onOpenLink }, 0)}</>
 }