Embed Notice

@feld @Tadano @PurpCat @mint It’s twofold:

1. We need a new upload filter called MimeFilter that lets you specify a whitelist of mime types with wildcard support, defaulting to audio/*, video/*, image/*
2. We need a plug at the end of /media and /proxy which blacklists a specific set of known harmful mimes including application/javascript and svg. Those should be rewritten to text/plain.

Bonus points: sanitizing the oembed html is good, but Pleroma FE actually needs to be patched to put the HTML into a sandboxed iframe. Soapbox doesn’t have this problem because it doesn’t blindly inject the oembed onto the page.