Make `AvatarContributor#allow` more targeted

[daniel-beck]

What feature do you want to see added?

Currently, AvatarContributor#allow extracts the domain and allows that. It would be preferable to only allow the specific URL.

We might run into length limitations there with lots of users, so #23887 seems like a potential prerequisite.

Upstream changes

No response

Are you interested in contributing this feature?

No response

[strangelookingnerd]

It would be preferable to only allow the specific URL.

I'm curious: Why is that preferable?

[daniel-beck]

Currently, letting authorized users add (legitimate, appropriate) images from random sites would allow unauthorized users to include other images from the same site. Depending on the site, that may be anything the internet can come up with, which could be unpleasant. So this is more "content moderation".

I'm currently unsure whether this should be a goal of CSP though -- it would only really help when users can specify an image URL but not a block of HTML, otherwise they can probably get there with an SVG.

[LakshyaBagani]

@daniel-beck I am interested in contribting to this issue .