Staging instance, all changes can be removed at any time

Skip to content

Disable unsafe directives when rendering READMEs

vlorentz requested to merge generated-differential-D7323-source into generated-differential-D7323-target

rst_to_html is called by get_readme_to_display, which processes unsafe data; so it should not allow inclusion of arbitrary files or arbitrary HTML.

Found thanks to this Sentry issue: https://sentry.softwareheritage.org/organizations/swh/issues/9247/

Migrated from D7323 (view on Phabricator)

Merge request reports