jeff/umap
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use DOMPurify in escapeHTML() for a global impact

Browse source
This commit is contained in:
David Larlet 2023-05-19 15:29:14 -04:00
parent fd3f854a9c
commit 3122286c8e
No known key found for this signature in database
1 changed files with 21 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
umap/static/umap/js/umap.core.js
View file

@ -44,7 +44,26 @@ L.Util.setNullableBooleanFromQueryString = (options, name) => {
}
L.Util.escapeHTML = (s) => {
s = s ? s.toString() : ''
return s.replace(/</gm, '&lt;')
s = DOMPurify.sanitize(s, {
USE_PROFILES: { html: true },
ALLOWED_TAGS: [
'h3',
'h4',
'h5',
'hr',
'strong',
'em',
'ul',
'li',
'a',
'div',
'iframe',
'img',
'br',
],
ALLOWED_ATTR: ['target', 'href', 'frameborder', 'src', 'width', 'height'],
})
return s
}
L.Util.toHTML = (r) => {
if (!r) return ''
@ -106,25 +125,7 @@ L.Util.toHTML = (r) => {
// Preserver line breaks
if (newline) r = r.replace(new RegExp(newline + '(?=[^]+)', 'g'), '<br>' + newline)
r = DOMPurify.sanitize(r, {
USE_PROFILES: { html: true },
ALLOWED_TAGS: [
'h3',
'h4',
'h5',
'hr',
'strong',
'em',
'ul',
'li',
'a',
'div',
'iframe',
'img',
'br',
],
ALLOWED_ATTR: ['target', 'href', 'frameborder', 'src', 'width', 'height'],
})
r = L.Util.escapeHTML(r)
return r
}