tedkulp/PrivateBin
1
0
Fork 0
mirror of https://github.com/PrivateBin/PrivateBin.git synced 2026-03-04 13:20:06 -05:00
Code Issues Packages Projects Releases Wiki Activity

refactor: introduce purifyHtmlConfigStrictSubset

Browse Source
This commit is contained in:
rugk
2026-02-23 16:45:31 +01:00
committed by GitHub
parent dcaa019599
commit 69e37c2c04
1 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
js/privatebin.js
View File

@@ -58,9 +58,23 @@ jQuery.PrivateBin = (function($) {
ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|magnet):)/i,
USE_PROFILES: {
html: true
}
},
};
/**
* DOMpurify settings for HTML content, where only a strict subset is allowed.
*
* NOTE: The key `USE_PROFILES` from {@see purifyHtmlConfig} needs to be excluded,
* as otherwise `USE_PROFILES` takes precedence.
*
* @private
*/
const purifyHtmlConfigStrictSubset {
ALLOWED_URI_REGEXP: purifyHtmlConfig.ALLOWED_URI_REGEXP,
ALLOWED_TAGS: ['a', 'i', 'span', 'kbd'],
ALLOWED_ATTR: ['href', 'id']
})
/**
* DOMpurify settings for SVG content
*
@@ -439,7 +453,7 @@ jQuery.PrivateBin = (function($) {
/(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig,
'<a href="$1" rel="nofollow noopener noreferrer">$1</a>'
),
purifyHtmlConfig
purifyHtmlConfigStrictSubset
)
);
};
@@ -812,12 +826,7 @@ jQuery.PrivateBin = (function($) {
if (containsHtml) {
// only allow tags/attributes we actually use in translations
const sanitizeConfig = {
...purifyHtmlConfig,
ALLOWED_TAGS: ['a', 'i', 'span', 'kbd'],
ALLOWED_ATTR: ['href', 'id']
});
output = DOMPurify.sanitize(output, sanitizeConfig);
output = DOMPurify.sanitize(output, purifyHtmlConfigStrictSubset);
}
// if $element is given, insert translation