In T138783#2419210, @brion wrote:

We seem to have a couple sub-issues here:

Sanitization options:

• always pass a safe subset of XHTML as foreign objects through the validator
• allowing sites to configure the SVG sanitizer to pass a believed-safe subset of embedded XHTML
• allowing sites to configure the SVG sanitizer to allow *any* XHTML through (unsafe for untrusted users)

In T138783#2417065, @bensond-drawio wrote:

We could write a draw.io plugin (that you'd invoke as a URL parameter when calling draw) when using draw in embed mode. That could switch off all UI functionality that causes HTML labels to be created, like word wrapping. That would then produce output with no FO sections. That doesn't solve the case of a user taking output from the online site, though, and restricts an important piece of functionality.

Just FYI: I've opened a request at draw.io's support site and asked them to join this discussion. The ticket itself is private so I can't provide a link, but I'll keep you posted.

In T138783#2414978, @RobLa-WMF wrote:

In T138783#2414818, @mgebert wrote:

@RobLa-WMF, I completely unterstand that you're having security concerns, although I think they're only valid for wiki installations with untrusted users. In a closed setup where only trusted people can upload, these concerns may be a minimal risk or even a non-issue, and the minimal checks you currently do (i.e. no iframe) may be more than good enough.

Wikimedia developers can't (and shouldn't) spend a lot of their time making features that work when everyone trusts each other. We spend a lot of time cleaning up messes created by naive developers that assume trust levels they shouldn't. Sometimes the "naive developer" is "a seasoned developer several years ago before they learned a few things the hard way" ;-)

@RobLa-WMF, I completely unterstand that you're having security concerns, although I think they're only valid for wiki installations with untrusted users. In a closed setup where only trusted people can upload, these concerns may be a minimal risk or even a non-issue, and the minimal checks you currently do (i.e. no iframe) may be more than good enough. In fact I've originally created the extension for such an environment.