-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: Replace html-sanitizer with dompurify (#4390)
- Loading branch information
1 parent
d7146e6
commit 3e1de9e
Showing
5 changed files
with
44 additions
and
96 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,46 @@ | ||
| import Service from '@ember/service'; | ||
| import sanitizeHtml from 'sanitize-html'; | ||
| import createDOMPurify from 'dompurify'; | ||
|
|
||
| export default Service.extend({ | ||
|
|
||
| sanitize: null, | ||
|
|
||
| _purify: null, | ||
|
|
||
| async init() { | ||
| this._super(...arguments); | ||
| if (typeof window !== 'undefined') { | ||
| this._purify = createDOMPurify(self); | ||
| } else { | ||
| const { JSDOM } = await import('jsdom'); | ||
|
|
||
| this._purify = createDOMPurify(new JSDOM('').window); | ||
| } | ||
| this._purify.addHook('beforeSanitizeElements', function(node) { | ||
| if ('href' in node) { | ||
| node.setAttribute('target', '_blank'); | ||
| node.setAttribute('rel', 'nofollow noopener'); | ||
| } | ||
| }); | ||
| }, | ||
|
|
||
| // Ensure any changes to the sanitizer rules are set in the rich text editor @ components/widgets/forms/rich-text-editor.js | ||
| options: { | ||
| allowedTags : ['b', 'strong', 'i', 'em', 'u', 'ol', 'ul', 'li', 'a', 'p'], | ||
| allowedAttributes : { | ||
| 'a': ['href', 'rel', 'target'] | ||
| }, | ||
| selfClosing : ['br'], | ||
| allowedSchemes : ['http', 'https', 'ftp', 'mailto'], | ||
| allowedSchemesByTag : {}, | ||
| allowProtocolRelative : false, | ||
| transformTags : { | ||
| 'i' : 'em', | ||
| 'b' : 'strong', | ||
| 'a' : sanitizeHtml.simpleTransform('a', { rel: 'nofollow', target: '_blank' }) | ||
| } | ||
| allowedAttributes : ['href', 'rel', 'target'] | ||
| }, | ||
|
|
||
| purify(string) { | ||
| return sanitizeHtml(string, this.options); | ||
| return this._purify.sanitize(string, { | ||
| ALLOWED_TAGS : this.options.allowedTags, | ||
| ALLOWED_ATTR : this.options.allowedAttributes | ||
| }); | ||
| }, | ||
|
|
||
| strip(string) { | ||
| return sanitizeHtml(string, { | ||
| allowedTags : [], | ||
| allowedAttributes : [] | ||
| return this._purify.sanitize(string, { | ||
| ALLOWED_TAGS : [], | ||
| ALLOWED_ATTR : [] | ||
| }); | ||
| } | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3e1de9eThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Successfully deployed to following URLs: