Anki is a smart spaced repetition flashcard program
Find a file
Damien Elmes bfc87c0427 Use CSP to block inline JS content in editor (#3939)
* Revert "Sanitize field content in editor"

This reverts commit 1c156905f8.

* Use CSP to block inline JS content in editor

This blocks inline scripts, scripts in the media folder, and
handlers like onclick in the editor. This is nicer than the previous
solution - it doesn't make any permanent changes, and leaves other
content like SVGs alone. Thanks to Nil Admirari for the suggestion.

(cherry picked from commit ddb8573e8d)
2025-04-23 16:23:18 +10:00
.buildkite Auto-expand bundle progress in Buildkite on Linux 2025-01-26 19:37:34 +11:00
.cargo Switch to SvelteKit (#3077) 2024-03-31 09:16:31 +01:00
.config Drop workspace-hack in favor of workspace deps 2023-06-23 17:41:31 +10:00
.github/ISSUE_TEMPLATE Move away from Bazel (#2202) 2022-11-27 15:24:20 +10:00
.vscode.dist HMR on Windows (#3144) 2024-04-17 21:23:34 +10:00
build Update n2 [action required] 2025-04-17 11:41:11 +10:00
cargo Latest Rust CVEs 2025-04-17 11:47:23 +10:00
docs Ignore SYNC_PORT and SYNC_BASE in syncserver Dockerfile (#3716) 2025-01-25 19:28:55 +11:00
ftl Update translations 2025-02-06 22:59:19 +07:00
proto Fix/re-optimize FSRS if short-term param is weird (#3742) 2025-01-26 10:42:17 +11:00
pylib Bump Rust to 1.84 2025-01-26 18:51:21 +11:00
python Hack in a fix for wheel generation 2025-01-27 01:20:58 +11:00
qt Use CSP to block inline JS content in editor (#3939) 2025-04-23 16:23:18 +10:00
rslib Check collection size when syncing 2025-04-17 11:42:54 +10:00
tools Update tokio, crossbeam-channel and cargo-deny 2025-04-17 11:46:57 +10:00
ts Use CSP to block inline JS content in editor (#3939) 2025-04-23 16:23:18 +10:00
.deny.toml Update tokio, crossbeam-channel and cargo-deny 2025-04-17 11:46:57 +10:00
.dockerignore Add distroless Dockerfile and implement internal health check (#3366) 2024-08-29 17:05:33 +07:00
.dprint.json Switch back to Prettier for Svelte formatting 2025-01-13 15:53:55 +11:00
.eslintrc.cjs Include error message text on page 2024-06-24 15:35:47 +07:00
.gitattributes try again to improve GitHub's language stats 2021-01-20 13:20:45 +10:00
.gitignore Yarn 4 (#3772) 2025-01-26 14:40:17 +11:00
.gitmodules Exclude PyOxidizer from recursive checkout 2023-07-02 18:22:44 +10:00
.isort.cfg Specify Python version for auto-formatters (#3325) 2024-08-04 20:54:14 +07:00
.mypy.ini Enable strict_optional for aqt/tagedit, utils, sync (#3578) 2024-11-15 16:29:19 +03:00
.prettierrc Switch back to Prettier for Svelte formatting 2025-01-13 15:53:55 +11:00
.pylintrc Add ability to restore a notetype to its original configuration (#2472) 2023-04-18 14:07:51 +10:00
.ruff.toml Specify Python version for auto-formatters (#3325) 2024-08-04 20:54:14 +07:00
.rustfmt-empty.toml Move away from Bazel (#2202) 2022-11-27 15:24:20 +10:00
.rustfmt.toml Move ascii_percent_encoding into a separate repo 2023-04-12 08:45:23 +10:00
.version Bump version 2025-04-17 11:16:26 +10:00
.yarnrc.yml Yarn 4 (#3772) 2025-01-26 14:40:17 +11:00
Cargo.lock Latest Rust CVEs 2025-04-17 11:47:23 +10:00
Cargo.toml Latest Rust CVEs 2025-04-17 11:47:23 +10:00
check Add a shortcut to auto-format before running checks 2023-07-02 09:59:05 +10:00
CONTRIBUTORS Update Deck Options strings to clarify Timers (#3792) 2025-02-06 15:17:30 +07:00
LICENSE Replace css_browser_selector with our own implementation (#2854) 2023-11-30 10:57:33 +10:00
ninja Switch to SvelteKit (#3077) 2024-03-31 09:16:31 +01:00
package.json Use CSP to block inline JS content in editor (#3939) 2025-04-23 16:23:18 +10:00
pkgkey.asc add public key for release signing 2018-09-18 10:40:45 +10:00
pyproject.toml chore: add initial configuration for pyright (#3361) 2024-08-17 13:10:02 +07:00
README.md Updated README (#2718) 2023-10-11 14:11:07 +10:00
run Fix webengine remote debugging in Qt6 2023-11-05 12:41:17 +10:00
run.bat HMR on Windows (#3144) 2024-04-17 21:23:34 +10:00
rust-toolchain.toml Update to Rust 1.85 2025-04-17 11:41:33 +10:00
SECURITY.md add SECURITY.md 2021-09-22 22:55:19 +10:00
yarn Switch to SvelteKit (#3077) 2024-03-31 09:16:31 +01:00
yarn.bat Switch to SvelteKit (#3077) 2024-03-31 09:16:31 +01:00
yarn.lock Use CSP to block inline JS content in editor (#3939) 2025-04-23 16:23:18 +10:00

Anki

Build status

This repo contains the source code for the computer version of Anki.

About

Anki is a spaced repetition program. Please see the website to learn more.

Getting Started

Anki Betas

If you'd like to try development builds of Anki but don't feel comfortable building the code, please see Anki betas

Developing

For more information on building and developing, please see Development.

Contributing

Want to contribute to Anki? Check out the Contribution Guidelines.

Anki Contributors

CONTRIBUTORS

License

Anki's license: LICENSE