From d14f943629dba10a540ebb6a0c0114d6dbb799e7 Mon Sep 17 00:00:00 2001
From: Luke Barnard <luke@matrix.org>
Date: Mon, 6 Nov 2017 17:52:46 +0000
Subject: [PATCH] Ignore img tags in HTML if src is not specified

This applies to HTML messages and group summaries.
---
 src/HtmlUtils.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/HtmlUtils.js b/src/HtmlUtils.js
index b306eab23c..0c262fe89a 100644
--- a/src/HtmlUtils.js
+++ b/src/HtmlUtils.js
@@ -208,7 +208,7 @@ const sanitizeHtmlParams = {
             // Strip out imgs that aren't `mxc` here instead of using allowedSchemesByTag
             // because transformTags is used _before_ we filter by allowedSchemesByTag and
             // we don't want to allow images with `https?` `src`s.
-            if (!attribs.src.startsWith('mxc://')) {
+            if (!attribs.src || !attribs.src.startsWith('mxc://')) {
                 return { tagName, attribs: {}};
             }
             attribs.src = MatrixClientPeg.get().mxcUrlToHttp(