Color in HTML section is not rendered

[nkh]

This link should display colored sections. If I am not mistaken, it worked before. It also works on cpan.org

https://metacpan.org/pod/Data::HexDump::Range

[haarg]

We filter HTML allowed pretty aggressively. In the past, we were more lax.

We don't want to allow arbitrary style values, but we could possibly whitelist some forms, such as text color.

[nkh]

Pod allows those sections, not allowing them in documentation is unwelcome. Documentation can't just be a boring grey blob. And that's what we have today, boring grey blobs, we need perl that is attractive to new users. And also be able to show what the modules does, eg: a module that does web thingies without being able to show them sounds pretty sad. Could you please let us know why you want to filter the html? cheers, N

…

On Fri, Apr 7, 2017 at 1:14 PM, Graham Knop ***@***.***> wrote: We filter HTML allowed pretty aggressively. In the past, we were more lax. We don't want to allow arbitrary style values, but we could possibly whitelist some forms, such as text color. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1863 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AACxYdXKfVjKlO3R0--Ti74VbBQ8FMnbks5rthqYgaJpZM4M2glU> .

[oalders]

@nkh our objective is not to make for a bland user experience, but to root out potential security issues. See https://github.com/metacpan/metacpan-web/blob/master/lib/MetaCPAN/Web/Controller/Pod.pm#L125

We also don't want anyone to arbitrarily override some of our styles etc. If you'd like to suggest some changes to the filtering, we can discuss it.

[nkh]

I am persuaded that you are not looking for a dulling the user experience.So let's forget about that.

Of course I guessed that there was a security issue.

what I believe is that the user documentation should be rendered as intended in the Pod. Maybe, and you are certainly able to answer this better than me, there is the possibility to render the html in some secure environment. I also understand that it complicates things.

I will discuss this with other, maybe write a blog entry or a FB post and see what other have to say about it; maybe I am the only one who noticed.

Thank you for your quick answer in any case.

[haarg]

What is needed here is first to extend HTML::Restrict to allow per-attribute filters based on callbacks. They we can write a filter that does some simple parsing of style attributes, and whitelist some styles.