mirror of
https://github.com/versia-pub/server.git
synced 2025-12-06 08:28:19 +01:00
feat(api): ✨ Reimplement HTML sanitization
This commit is contained in:
Jesse Wierzbinski
parent
cac726ac1b
commit
febddc2a8b
213
package.json
213
package.json
|
|
@ -1,109 +1,110 @@
|
||||||
{
|
{
|
||||||
"name": "lysand",
|
"name": "lysand",
|
||||||
"module": "index.ts",
|
"module": "index.ts",
|
||||||
"type": "module",
|
"type": "module",
|
||||||
"version": "0.5.0",
|
"version": "0.5.0",
|
||||||
"description": "A project to build a federated social network",
|
"description": "A project to build a federated social network",
|
||||||
"author": {
|
"author": {
|
||||||
"email": "contact@cpluspatch.com",
|
"email": "contact@cpluspatch.com",
|
||||||
"name": "CPlusPatch",
|
"name": "CPlusPatch",
|
||||||
"url": "https://cpluspatch.com"
|
"url": "https://cpluspatch.com"
|
||||||
},
|
},
|
||||||
"bugs": {
|
"bugs": {
|
||||||
"url": "https://github.com/lysand-org/lysand/issues"
|
"url": "https://github.com/lysand-org/lysand/issues"
|
||||||
},
|
},
|
||||||
"icon": "https://github.com/lysand-org/lysand",
|
"icon": "https://github.com/lysand-org/lysand",
|
||||||
"license": "AGPL-3.0",
|
"license": "AGPL-3.0",
|
||||||
"keywords": ["federated", "activitypub", "bun"],
|
"keywords": ["federated", "activitypub", "bun"],
|
||||||
"workspaces": ["packages/*"],
|
"workspaces": ["packages/*"],
|
||||||
"maintainers": [
|
"maintainers": [
|
||||||
{
|
{
|
||||||
"email": "contact@cpluspatch.com",
|
"email": "contact@cpluspatch.com",
|
||||||
"name": "CPlusPatch",
|
"name": "CPlusPatch",
|
||||||
"url": "https://cpluspatch.com"
|
"url": "https://cpluspatch.com"
|
||||||
}
|
|
||||||
],
|
|
||||||
"repository": {
|
|
||||||
"type": "git",
|
|
||||||
"url": "git+https://github.com/lysand-org/lysand.git"
|
|
||||||
},
|
|
||||||
"private": true,
|
|
||||||
"scripts": {
|
|
||||||
"dev": "bun run --watch index.ts",
|
|
||||||
"start": "NODE_ENV=production bun run dist/index.js --prod",
|
|
||||||
"lint": "bunx @biomejs/biome check .",
|
|
||||||
"prod-build": "bun run build.ts",
|
|
||||||
"benchmark:timeline": "bun run benchmarks/timelines.ts",
|
|
||||||
"cloc": "cloc . --exclude-dir node_modules,dist,.output,.nuxt,meta,logs,glitch,glitch-dev --exclude-ext sql,log,pem",
|
|
||||||
"cli": "bun run cli.ts"
|
|
||||||
},
|
|
||||||
"trustedDependencies": [
|
|
||||||
"@biomejs/biome",
|
|
||||||
"@fortawesome/fontawesome-common-types",
|
|
||||||
"@fortawesome/free-regular-svg-icons",
|
|
||||||
"@fortawesome/free-solid-svg-icons",
|
|
||||||
"es5-ext",
|
|
||||||
"esbuild",
|
|
||||||
"json-editor-vue",
|
|
||||||
"msgpackr-extract",
|
|
||||||
"nuxt-app",
|
|
||||||
"sharp",
|
|
||||||
"vue-demi"
|
|
||||||
],
|
|
||||||
"devDependencies": {
|
|
||||||
"@biomejs/biome": "^1.7.0",
|
|
||||||
"@types/cli-table": "^0.3.4",
|
|
||||||
"@types/html-to-text": "^9.0.4",
|
|
||||||
"@types/ioredis": "^5.0.0",
|
|
||||||
"@types/jsonld": "^1.5.13",
|
|
||||||
"@types/markdown-it-container": "^2.0.10",
|
|
||||||
"@types/mime-types": "^2.1.4",
|
|
||||||
"@types/pg": "^8.11.5",
|
|
||||||
"bun-types": "latest",
|
|
||||||
"drizzle-kit": "^0.20.14",
|
|
||||||
"typescript": "latest"
|
|
||||||
},
|
|
||||||
"peerDependencies": {
|
|
||||||
"typescript": "^5.3.2"
|
|
||||||
},
|
|
||||||
"dependencies": {
|
|
||||||
"@hackmd/markdown-it-task-lists": "^2.1.4",
|
|
||||||
"@json2csv/plainjs": "^7.0.6",
|
|
||||||
"@shikijs/markdown-it": "^1.3.0",
|
|
||||||
"@tufjs/canonical-json": "^2.0.0",
|
|
||||||
"blurhash": "^2.0.5",
|
|
||||||
"bullmq": "^5.7.1",
|
|
||||||
"chalk": "^5.3.0",
|
|
||||||
"cli-parser": "workspace:*",
|
|
||||||
"cli-table": "^0.3.11",
|
|
||||||
"config-manager": "workspace:*",
|
|
||||||
"drizzle-orm": "^0.30.7",
|
|
||||||
"extract-zip": "^2.0.1",
|
|
||||||
"html-to-text": "^9.0.5",
|
|
||||||
"ioredis": "^5.3.2",
|
|
||||||
"ip-matching": "^2.1.2",
|
|
||||||
"iso-639-1": "^3.1.0",
|
|
||||||
"isomorphic-dompurify": "latest",
|
|
||||||
"jose": "^5.2.4",
|
|
||||||
"linkify-html": "^4.1.3",
|
|
||||||
"linkify-string": "^4.1.3",
|
|
||||||
"linkifyjs": "^4.1.3",
|
|
||||||
"log-manager": "workspace:*",
|
|
||||||
"magic-regexp": "^0.8.0",
|
|
||||||
"markdown-it": "^14.1.0",
|
|
||||||
"markdown-it-anchor": "^8.6.7",
|
|
||||||
"markdown-it-container": "^4.0.0",
|
|
||||||
"markdown-it-toc-done-right": "^4.2.0",
|
|
||||||
"media-manager": "workspace:*",
|
|
||||||
"megalodon": "^10.0.0",
|
|
||||||
"meilisearch": "^0.38.0",
|
|
||||||
"mime-types": "^2.1.35",
|
|
||||||
"oauth4webapi": "^2.4.0",
|
|
||||||
"pg": "^8.11.5",
|
|
||||||
"request-parser": "workspace:*",
|
|
||||||
"sharp": "^0.33.3",
|
|
||||||
"string-comparison": "^1.3.0",
|
|
||||||
"zod": "^3.22.4",
|
|
||||||
"zod-validation-error": "^3.2.0"
|
|
||||||
}
|
}
|
||||||
|
],
|
||||||
|
"repository": {
|
||||||
|
"type": "git",
|
||||||
|
"url": "git+https://github.com/lysand-org/lysand.git"
|
||||||
|
},
|
||||||
|
"private": true,
|
||||||
|
"scripts": {
|
||||||
|
"dev": "bun run --watch index.ts",
|
||||||
|
"start": "NODE_ENV=production bun run dist/index.js --prod",
|
||||||
|
"lint": "bunx @biomejs/biome check .",
|
||||||
|
"prod-build": "bun run build.ts",
|
||||||
|
"benchmark:timeline": "bun run benchmarks/timelines.ts",
|
||||||
|
"cloc": "cloc . --exclude-dir node_modules,dist,.output,.nuxt,meta,logs,glitch,glitch-dev --exclude-ext sql,log,pem",
|
||||||
|
"cli": "bun run cli.ts"
|
||||||
|
},
|
||||||
|
"trustedDependencies": [
|
||||||
|
"@biomejs/biome",
|
||||||
|
"@fortawesome/fontawesome-common-types",
|
||||||
|
"@fortawesome/free-regular-svg-icons",
|
||||||
|
"@fortawesome/free-solid-svg-icons",
|
||||||
|
"es5-ext",
|
||||||
|
"esbuild",
|
||||||
|
"json-editor-vue",
|
||||||
|
"msgpackr-extract",
|
||||||
|
"nuxt-app",
|
||||||
|
"sharp",
|
||||||
|
"vue-demi"
|
||||||
|
],
|
||||||
|
"devDependencies": {
|
||||||
|
"@biomejs/biome": "^1.7.0",
|
||||||
|
"@types/cli-table": "^0.3.4",
|
||||||
|
"@types/html-to-text": "^9.0.4",
|
||||||
|
"@types/ioredis": "^5.0.0",
|
||||||
|
"@types/jsonld": "^1.5.13",
|
||||||
|
"@types/markdown-it-container": "^2.0.10",
|
||||||
|
"@types/mime-types": "^2.1.4",
|
||||||
|
"@types/pg": "^8.11.5",
|
||||||
|
"bun-types": "latest",
|
||||||
|
"drizzle-kit": "^0.20.14",
|
||||||
|
"typescript": "latest"
|
||||||
|
},
|
||||||
|
"peerDependencies": {
|
||||||
|
"typescript": "^5.3.2"
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"@hackmd/markdown-it-task-lists": "^2.1.4",
|
||||||
|
"@json2csv/plainjs": "^7.0.6",
|
||||||
|
"@shikijs/markdown-it": "^1.3.0",
|
||||||
|
"@tufjs/canonical-json": "^2.0.0",
|
||||||
|
"blurhash": "^2.0.5",
|
||||||
|
"bullmq": "^5.7.1",
|
||||||
|
"chalk": "^5.3.0",
|
||||||
|
"cli-parser": "workspace:*",
|
||||||
|
"cli-table": "^0.3.11",
|
||||||
|
"config-manager": "workspace:*",
|
||||||
|
"dompurify": "^3.1.2",
|
||||||
|
"drizzle-orm": "^0.30.7",
|
||||||
|
"extract-zip": "^2.0.1",
|
||||||
|
"happy-dom": "14.5.0",
|
||||||
|
"html-to-text": "^9.0.5",
|
||||||
|
"ioredis": "^5.3.2",
|
||||||
|
"ip-matching": "^2.1.2",
|
||||||
|
"iso-639-1": "^3.1.0",
|
||||||
|
"isomorphic-dompurify": "latest",
|
||||||
|
"jose": "^5.2.4",
|
||||||
|
"linkify-html": "^4.1.3",
|
||||||
|
"linkify-string": "^4.1.3",
|
||||||
|
"linkifyjs": "^4.1.3",
|
||||||
|
"log-manager": "workspace:*",
|
||||||
|
"magic-regexp": "^0.8.0",
|
||||||
|
"markdown-it": "^14.1.0",
|
||||||
|
"markdown-it-anchor": "^8.6.7",
|
||||||
|
"markdown-it-container": "^4.0.0",
|
||||||
|
"markdown-it-toc-done-right": "^4.2.0",
|
||||||
|
"media-manager": "workspace:*",
|
||||||
|
"meilisearch": "^0.38.0",
|
||||||
|
"mime-types": "^2.1.35",
|
||||||
|
"oauth4webapi": "^2.4.0",
|
||||||
|
"pg": "^8.11.5",
|
||||||
|
"request-parser": "workspace:*",
|
||||||
|
"sharp": "^0.33.3",
|
||||||
|
"string-comparison": "^1.3.0",
|
||||||
|
"zod": "^3.22.4",
|
||||||
|
"zod-validation-error": "^3.2.0"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -97,19 +97,10 @@ export default apiRoute<typeof meta, typeof schema>(
|
||||||
|
|
||||||
const sanitizedNote = await sanitizeHtml(note ?? "");
|
const sanitizedNote = await sanitizeHtml(note ?? "");
|
||||||
|
|
||||||
const sanitizedDisplayName = display_name ?? ""; /* sanitize(display_name ?? "", {
|
const sanitizedDisplayName = await sanitizeHtml(display_name ?? "", {
|
||||||
ALLOWED_TAGS: [],
|
ALLOWED_TAGS: [],
|
||||||
ALLOWED_ATTR: [],
|
ALLOWED_ATTR: [],
|
||||||
});
|
});
|
||||||
*/
|
|
||||||
/* if (!user.source) {
|
|
||||||
user.source = {
|
|
||||||
privacy: "public",
|
|
||||||
sensitive: false,
|
|
||||||
language: "en",
|
|
||||||
note: "",
|
|
||||||
};
|
|
||||||
} */
|
|
||||||
|
|
||||||
let mediaManager: MediaBackend;
|
let mediaManager: MediaBackend;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,14 @@
|
||||||
import { config } from "config-manager";
|
import { config } from "config-manager";
|
||||||
// import { sanitize } from "isomorphic-dompurify";
|
import type DOMPurify from "dompurify";
|
||||||
|
import createDomPurify from "dompurify";
|
||||||
|
import { Window } from "happy-dom";
|
||||||
|
|
||||||
export const sanitizeHtml = async (html: string) => {
|
const window = new Window();
|
||||||
// TEMP: Allow all tags and attributes
|
// @ts-expect-error Mismatch between types, but they're okay i swear
|
||||||
return html;
|
const purifier = createDomPurify(window);
|
||||||
/* const sanitizedHtml = sanitize(html, {
|
|
||||||
|
export const sanitizeHtml = async (html: string, extraConfig?: DOMPurify.Config) => {
|
||||||
|
const sanitizedHtml = purifier.sanitize(html, {
|
||||||
ALLOWED_TAGS: [
|
ALLOWED_TAGS: [
|
||||||
"a",
|
"a",
|
||||||
"p",
|
"p",
|
||||||
|
|
@ -40,7 +44,8 @@ export const sanitizeHtml = async (html: string) => {
|
||||||
USE_PROFILES: {
|
USE_PROFILES: {
|
||||||
mathMl: true,
|
mathMl: true,
|
||||||
},
|
},
|
||||||
});
|
...extraConfig,
|
||||||
|
}) as string;
|
||||||
|
|
||||||
// Check text to only allow h-*, p-*, u-*, dt-*, e-*, mention, hashtag, ellipsis, invisible classes
|
// Check text to only allow h-*, p-*, u-*, dt-*, e-*, mention, hashtag, ellipsis, invisible classes
|
||||||
const allowedClasses = [
|
const allowedClasses = [
|
||||||
|
|
@ -72,5 +77,5 @@ export const sanitizeHtml = async (html: string) => {
|
||||||
},
|
},
|
||||||
})
|
})
|
||||||
.transform(new Response(sanitizedHtml))
|
.transform(new Response(sanitizedHtml))
|
||||||
.text(); */
|
.text();
|
||||||
};
|
};
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue