contrapunctus/MapComplete
1
0
Fork 0
forked from MapComplete/MapComplete
Code Pull requests Activity

Security: purify inputs around innerHTML-usage, remove some unused parameters and classes

Browse source
This commit is contained in:
Pieter Vander Vennet 2023-09-21 01:53:34 +02:00
parent e0ee3edf71
commit fcea3da70f
15 changed files with 44 additions and 127 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/UI/Base/FromHtml.svelte
View file

@ -2,18 +2,14 @@
/**
* Given an HTML string, properly shows this
*/
import DOMPurify from 'dompurify';
import { Utils } from "../../Utils";
export let src: string
let cleaned = DOMPurify.sanitize(src, { USE_PROFILES: { html: true },
ADD_ATTR: ['target'] // Don't remove target='_blank'. Note that Utils.initDomPurify does add a hook which automatically adds 'rel=noopener'
});
let htmlElem: HTMLElement
$: {
if (htmlElem) {
htmlElem.innerHTML = cleaned
htmlElem.innerHTML = Utils.purify(src)
}
}