Security: purify inputs around innerHTML-usage, remove some unused parameters and classes

src/UI/Base/CenterFlexedElement.ts

@@ -1,32 +0,0 @@
-import BaseUIElement from "../BaseUIElement"
-
-export class CenterFlexedElement extends BaseUIElement {
-    private _html: string
-
-    constructor(html: string) {
-        super()
-        this._html = html ?? ""
-    }
-
-    InnerRender(): string {
-        return this._html
-    }
-
-    AsMarkdown(): string {
-        return this._html
-    }
-
-    protected InnerConstructElement(): HTMLElement {
-        const e = document.createElement("div")
-        e.innerHTML = this._html
-        e.style.display = "flex"
-        e.style.height = "100%"
-        e.style.width = "100%"
-        e.style.flexDirection = "column"
-        e.style.flexWrap = "nowrap"
-        e.style.alignContent = "center"
-        e.style.justifyContent = "center"
-        e.style.alignItems = "center"
-        return e
-    }
-}

src/UI/Base/FixedUiElement.ts

@@ -1,5 +1,8 @@
 import BaseUIElement from "../BaseUIElement"
-
+import { Utils } from "../../Utils"
+/**
+ * @deprecated
+ */
 export class FixedUiElement extends BaseUIElement {
     public readonly content: string
 
@@ -8,10 +11,6 @@ export class FixedUiElement extends BaseUIElement {
         this.content = html ?? ""
     }
 
-    InnerRender(): string {
-        return this.content
-    }
-
     AsMarkdown(): string {
         if (this.HasClass("code")) {
             if (this.content.indexOf("\n") > 0 || this.HasClass("block")) {
@@ -27,7 +26,7 @@ export class FixedUiElement extends BaseUIElement {
 
     protected InnerConstructElement(): HTMLElement {
         const e = document.createElement("span")
-        e.innerHTML = this.content
+        e.innerHTML = Utils.purify(this.content)
         return e
     }
 }

src/UI/Base/FromHtml.svelte

@@ -2,18 +2,14 @@
   /**
    * Given an HTML string, properly shows this
    */
-  import DOMPurify from 'dompurify';
+  import { Utils } from "../../Utils";
+
   export let src: string
-  
-  let cleaned = DOMPurify.sanitize(src, { USE_PROFILES: { html: true }, 
-    ADD_ATTR: ['target']  // Don't remove target='_blank'. Note that Utils.initDomPurify does add a hook which automatically adds 'rel=noopener'
-  });
-  
-  
+
   let htmlElem: HTMLElement
   $: {
     if (htmlElem) {
-      htmlElem.innerHTML = cleaned
+      htmlElem.innerHTML = Utils.purify(src)
     }
   }
 

src/UI/Base/VariableUIElement.ts

@@ -1,7 +1,11 @@
 import { Store } from "../../Logic/UIEventSource"
 import BaseUIElement from "../BaseUIElement"
 import Combine from "./Combine"
+import { Utils } from "../../Utils"
 
+/**
+ * @deprecated
+ */
 export class VariableUiElement extends BaseUIElement {
     private readonly _contents?: Store<string | BaseUIElement | BaseUIElement[]>
 
@@ -42,7 +46,7 @@ export class VariableUiElement extends BaseUIElement {
                 return
             }
             if (typeof contents === "string") {
-                el.innerHTML = contents
+                el.innerHTML = Utils.purify(contents)
             } else if (contents instanceof Array) {
                 for (const content of contents) {
                     const c = content?.ConstructElement()

src/UI/InputElement/Validators/FediverseValidator.ts

@@ -40,7 +40,7 @@ export default class FediverseValidator extends Validator {
         if (match) {
             const host = match[2]
             try {
-                const url = new URL("https://" + host)
+                new URL("https://" + host)
                 return undefined
             } catch (e) {
                 return Translations.t.validation.fediverse.invalidHost.Subs({ host })

src/UI/Popup/NoteCommentElement.ts

@@ -56,7 +56,7 @@ export default class NoteCommentElement extends Combine {
         )
 
         const htmlElement = document.createElement("div")
-        htmlElement.innerHTML = comment.html
+        htmlElement.innerHTML = Utils.purify(comment.html)
         const images = Array.from(htmlElement.getElementsByTagName("a"))
             .map((link) => link.href)
             .filter((link) => {