Cherry pick #6679 to ev3 stable

Jakefile.js

@@ -438,6 +438,7 @@ file('built/web/main.js', ["built/web/pxtapp.js", "built/webapp/src/app.js"], {
 
 ju.catFiles('built/web/pxtapp.js', [
     "node_modules/lzma/src/lzma_worker-min.js",
+    "node_modules/dompurify/dist/purify.min.js",
     "built/web/pxtlib.js",
     "built/web/pxtwinrt.js",
     "built/web/pxteditor.js",
@@ -452,13 +453,15 @@ ju.catFiles('built/web/pxtworker.js', [
     "built/web/typescript.js",
     "node_modules/fuse.js/dist/fuse.min.js",
     "node_modules/lzma/src/lzma_worker-min.js",
+    "node_modules/dompurify/dist/purify.min.js",
     "built/web/pxtlib.js",
     "built/web/pxtcompiler.js"
 ], `"use strict";`, ["built/webapp/src/app.js"]);
 
 ju.catFiles('built/web/pxtembed.js', [
     "built/web/typescript.js",
     "node_modules/lzma/src/lzma_worker-min.js",
+    "node_modules/dompurify/dist/purify.min.js",
     "built/web/pxtlib.js",
     "built/web/pxtcompiler.js",
     "built/web/pxtblockly.js",

cli/cli.ts

@@ -29,6 +29,8 @@ import * as gitfs from './gitfs';
 
 const rimraf: (f: string, opts: any, cb: (err: any, res: any) => void) => void = require('rimraf');
 
+pxt.docs.requireDOMSanitizer = () => require("sanitize-html");
+
 let forceCloudBuild = process.env["KS_FORCE_CLOUD"] !== "no";
 let forceLocalBuild = process.env["PXT_FORCE_LOCAL"] === "yes"
 

localtypings/dompurify.d.ts

@@ -0,0 +1,3 @@
+declare namespace DOMPurify {
+    function sanitize(dirty: string): string;
+}

package.json

@@ -61,7 +61,9 @@
     "rtlcss": "2.2.1",
     "cssnano": "3.10.0",
     "less": "2.7.3",
-    "semantic-ui-less": "2.2.14"
+    "semantic-ui-less": "2.2.14",
+    "dompurify": "2.0.8",
+    "sanitize-html": "1.22.0"
   },
   "lazyDependencies": {
     "keytar": "4.2.1",

pxtlib/docsrender.ts

@@ -1,4 +1,5 @@
 /// <reference path='../localtypings/pxtarget.d.ts' />
+/// <reference path='../localtypings/dompurify.d.ts' />
 /// <reference path="commonutil.ts"/>
 
 namespace pxt.docs {
@@ -80,6 +81,12 @@ namespace pxt.docs {
         return require("marked") as typeof marked;
     }
 
+    export let requireDOMSanitizer = () => {
+        if (typeof DOMPurify !== "undefined") return DOMPurify.sanitize;
+        if (typeof require === "undefined") return undefined;
+        return (require("DOMPurify") as typeof DOMPurify).sanitize;
+    }
+
     export interface RenderData {
         html: string;
         theme: AppTheme;
@@ -469,13 +476,16 @@ namespace pxt.docs {
             const html = linkRenderer.call(renderer, href, title, text);
             return html.replace(/^<a /, `<a ${target ? `target="${target}"` : ''} rel="nofollow noopener" `);
         };
+
+        let sanitizer = requireDOMSanitizer();
         markedInstance.setOptions({
             renderer: renderer,
             gfm: true,
             tables: true,
             breaks: false,
             pedantic: false,
             sanitize: true,
+            sanitizer: sanitizer,
             smartLists: true,
             smartypants: true
         });
@@ -789,13 +799,15 @@ ${opts.repo.name.replace(/^pxt-/, '')}=github:${opts.repo.fullName}#${opts.repo.
             return null
 
         const markedInstance = pxt.docs.requireMarked();
+        const sanitizer = requireDOMSanitizer();
         const options = {
             renderer: new markedInstance.Renderer(),
             gfm: true,
             tables: false,
             breaks: false,
             pedantic: false,
-            sanitize: false,
+            sanitize: true,
+            sanitizer: sanitizer,
             smartLists: false,
             smartypants: false
         };

webapp/src/marked.tsx

@@ -1,3 +1,4 @@
+/// <reference path='../../localtypings/dompurify.d.ts' />
 
 import * as React from "react";
 import * as ReactDOM from "react-dom";
@@ -118,7 +119,8 @@ export class MarkedContent extends data.Component<MarkedContentProps, MarkedCont
         // Set markdown options
         marked.setOptions({
             renderer: renderer,
-            sanitize: true
+            sanitize: true,
+            sanitizer: pxt.docs.requireDOMSanitizer()
         })
 
         // Render the markdown and add it to the content div