@@ -6,7 +6,7 @@ import { useCoreStore } from '../stores/core';
66import { useUserStore } from '../stores/user' ;
77import { Dropdown } from 'flowbite' ;
88import adminforth , { useAdminforth } from '../adminforth' ;
9- import sanitizeHtml from 'sanitize-html '
9+ import DOMPurify from 'dompurify '
1010import debounce from 'debounce' ;
1111import type { AdminForthActionFront , AdminForthResourceColumnInputCommon , AdminForthResourceFrontend , Predicate } from '@/types/Common' ;
1212import { i18nInstance } from '../i18n'
@@ -337,26 +337,24 @@ export function humanifySize(size: number) {
337337}
338338
339339export function protectAgainstXSS ( value : string ) {
340- return sanitizeHtml ( value , {
341- allowedTags : [
342- "address" , "article" , "aside" , "footer" , "header" , "h1" , "h2" , "h3" , "h4" ,
343- "h5" , "h6" , "hgroup" , "main" , "nav" , "section" , "blockquote" , "dd" , "div" ,
344- "dl" , "dt" , "figcaption" , "figure" , "hr" , "li" , "main" , "ol" , "p" , "pre" ,
345- "ul" , "a" , "abbr" , "b" , "bdi" , "bdo" , "br" , "cite" , "code" , "data" , "dfn" ,
346- "em" , "i" , "kbd" , "mark" , "q" , "rb" , "rp" , "rt" , "rtc" , "ruby" , "s" , "samp" ,
347- "small" , "span" , "strong" , "sub" , "sup" , "time" , "u" , "var" , "wbr" , "caption" ,
348- "col" , "colgroup" , "table" , "tbody" , "td" , "tfoot" , "th" , "thead" , "tr" , 'img' , 'video' , 'source'
340+ return DOMPurify . sanitize ( value , {
341+ ALLOWED_TAGS : [
342+ "address" , "article" , "aside" , "footer" , "header" , "h1" , "h2" , "h3" , "h4" ,
343+ "h5" , "h6" , "hgroup" , "main" , "nav" , "section" , "blockquote" , "dd" , "div" ,
344+ "dl" , "dt" , "figcaption" , "figure" , "hr" , "li" , "ol" , "p" , "pre" ,
345+ "ul" , "a" , "abbr" , "b" , "bdi" , "bdo" , "br" , "cite" , "code" , "data" , "dfn" ,
346+ "em" , "i" , "kbd" , "mark" , "q" , "rb" , "rp" , "rt" , "rtc" , "ruby" , "s" , "samp" ,
347+ "small" , "span" , "strong" , "sub" , "sup" , "time" , "u" , "var" , "wbr" , "caption" ,
348+ "col" , "colgroup" , "table" , "tbody" , "td" , "tfoot" , "th" , "thead" , "tr" ,
349+ "img" , "video" , "source"
349350 ] ,
350- allowedAttributes : {
351- 'li' : [ 'data-list' ] ,
352- 'img' : [ 'src' , 'srcset' , 'alt' , 'title' , 'width' , 'height' , 'loading' ] ,
353- 'video' : [ 'src' , 'controls' , 'autoplay' , 'loop' , 'muted' , 'poster' , 'width' , 'height' , 'autoplay' , 'playsinline' ] ,
354- 'source' : [ 'src' , 'type' ] ,
355- // Allow markup on spans (classes & styles), and
356- // generic data/aria/style attributes on any element. (e.g. for KaTeX-related previews)
357- 'span' : [ 'class' , 'style' ] ,
358- '*' : [ 'data-*' , 'aria-*' , 'style' ]
359- } ,
351+ ALLOWED_ATTR : [
352+ "data-list" ,
353+ "src" , "srcset" , "alt" , "title" , "width" , "height" , "loading" ,
354+ "controls" , "autoplay" , "loop" , "muted" , "poster" , "playsinline" ,
355+ "class" , "style" ,
356+ "data-*" , "aria-*"
357+ ]
360358 } ) ;
361359}
362360
0 commit comments