wikijs-fork/server/modules/rendering/html-security/renderer.js

58 lines
2.2 KiB
JavaScript
Raw Normal View History

2019-12-12 04:35:54 +00:00
const xss = require('xss')
2018-09-16 04:35:03 +00:00
2019-12-12 04:35:54 +00:00
module.exports = {
async init(input, config) {
if (config.safeHTML) {
input = xss(input, {
whiteList: {
...xss.whiteList,
a: ['class', 'id', 'href', 'style', 'target', 'title'],
blockquote: ['class', 'id', 'style'],
code: ['class', 'style'],
details: ['class', 'style'],
defs: ['stroke', 'fill', 'stroke-width', 'transform', 'id'],
div: ['class', 'id', 'style'],
em: ['class', 'style'],
figcaption: ['class', 'style', 'id'],
figure: ['class', 'style', 'id'],
2020-04-30 02:30:56 +00:00
g: ['transform', 'stroke', 'stroke-width', 'fill'],
h1: ['class', 'id', 'style'],
h2: ['class', 'id', 'style'],
h3: ['class', 'id', 'style'],
h4: ['class', 'id', 'style'],
h5: ['class', 'id', 'style'],
h6: ['class', 'id', 'style'],
i: ['class', 'id', 'style'],
img: ['alt', 'class', 'draggable', 'height', 'id', 'src', 'style', 'width'],
2020-03-21 16:49:25 +00:00
input: ['class', 'disabled', 'type', 'checked', 'id'],
2020-02-08 21:11:35 +00:00
kbd: ['class'],
2020-03-21 16:49:25 +00:00
label: ['class', 'id', 'for'],
li: ['class', 'id', 'style'],
2020-01-11 00:48:16 +00:00
mark: ['class', 'style'],
ol: ['class', 'id', 'style', 'start'],
p: ['class', 'id', 'style'],
2020-04-30 02:30:56 +00:00
path: ['d', 'style', 'id'],
pre: ['class', 'id', 'style'],
section: ['class', 'style'],
span: ['class', 'style', 'aria-hidden'],
strong: ['class', 'style'],
summary: ['class', 'id', 'style'],
svg: ['width', 'height', 'viewbox', 'preserveaspectratio', 'style'],
table: ['border', 'class', 'id', 'style', 'width'],
2020-04-27 01:04:08 +00:00
tabset: [],
tbody: ['class', 'style'],
td: ['align', 'class', 'colspan', 'rowspan', 'style', 'valign', 'id'],
2020-04-27 01:04:08 +00:00
template: ['v-slot:tabs', 'v-slot:content'],
th: ['align', 'class', 'colspan', 'rowspan', 'style', 'valign', 'id'],
thead: ['class', 'style'],
tr: ['class', 'rowspan', 'style', 'align', 'valign', 'id'],
ul: ['class', 'id', 'style'],
2020-04-30 02:30:56 +00:00
use: ['href', 'transform']
},
css: false
2019-12-12 04:35:54 +00:00
})
}
return input
2018-09-16 04:35:03 +00:00
}
}