From 8c5c4b02fbfd1f9a35897865b652f372588108ef Mon Sep 17 00:00:00 2001 From: Simon Chopin Date: Wed, 1 Jul 2026 14:49:57 +0200 Subject: [PATCH] thread: add trusted hosts for remote requests There are a few cases where I actually *want* remote requests. --- dodo/settings.py | 7 +++++++ dodo/thread.py | 9 +++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/dodo/settings.py b/dodo/settings.py index c112eb2..01f6d49 100644 --- a/dodo/settings.py +++ b/dodo/settings.py @@ -189,6 +189,13 @@ from embedded image tags or iframes. If set to True, Dodo will not allow these requests. """ +html_block_remote_requests_trusted_hosts = [] +"""A list of trusted hosts for HTML remote requests. + +Dodo will let any request to those hosts through, even if +:func:`~dodo.settings.html_block_remote_requests` is True. +""" + html_confirm_open_links = True """Display a confirmation dialog before opening a link in browser diff --git a/dodo/thread.py b/dodo/thread.py index f15419d..865f966 100644 --- a/dodo/thread.py +++ b/dodo/thread.py @@ -202,8 +202,13 @@ def requestStarted(self, request: QWebEngineUrlRequestJob) -> None: class RemoteBlockingUrlRequestInterceptor(QWebEngineUrlRequestInterceptor): def interceptRequest(self, info): - if info.requestUrl().scheme() not in app.LOCAL_PROTOCOLS: - info.block(settings.html_block_remote_requests) + url = info.requestUrl() + if url.scheme() not in app.LOCAL_PROTOCOLS: + trusted_hosts = settings.html_block_remote_requests_trusted_hosts + info.block( + settings.html_block_remote_requests + and url.host() not in trusted_hosts + ) RE_REGEX = re.compile(r'^R[Ee]: ') class ThreadItem: