diff --git a/scripts/apidoc/signature.ts b/scripts/apidoc/signature.ts index 7a8309ee84b..69ef58e816e 100644 --- a/scripts/apidoc/signature.ts +++ b/scripts/apidoc/signature.ts @@ -1,4 +1,4 @@ -// import sanitizeHtml from 'sanitize-html'; +import sanitizeHtml from 'sanitize-html'; import type { Comment, DeclarationReflection, @@ -50,31 +50,40 @@ export async function initMarkdownRenderer(): Promise { ); } -// const htmlSanitizeOptions: sanitizeHtml.IOptions = { -// allowedTags: ['a', 'code', 'div', 'li', 'span', 'p', 'pre', 'ul'], -// allowedAttributes: { -// a: ['href', 'target', 'rel'], -// div: ['class'], -// pre: ['v-pre'], -// span: ['class'], -// }, -// selfClosing: [], -// }; +const htmlSanitizeOptions: sanitizeHtml.IOptions = { + allowedTags: ['a', 'button', 'code', 'div', 'li', 'span', 'p', 'pre', 'ul'], + allowedAttributes: { + a: ['href', 'target', 'rel'], + button: ['class', 'title'], + div: ['class'], + pre: ['class', 'v-pre'], + span: ['class', 'style'], + }, + selfClosing: [], +}; + +function comparableSanitizedHtml(html: string): string { + return html + .replace(/>/g, '>') + .replace(/ /g, '') + .replace(/"/g, '"') + .replace(/'/g, "'"); +} function mdToHtml(md: string): string { const rawHtml = markdown.render(md); - // TODO @Shinigami92 2022-06-24: Sanitize html to prevent XSS - return rawHtml; - // const safeHtml: string = sanitizeHtml(rawHtml, htmlSanitizeOptions); - // // Revert some escaped characters for comparison. - // if (rawHtml.replace(/>/g, '>') === safeHtml.replace(/>/g, '>')) { - // return safeHtml; - // } else { - // console.debug('Rejected unsafe md:', md); - // console.error('Rejected unsafe html:', rawHtml.replace(/>/g, '>')); - // console.error('Expected safe html:', safeHtml.replace(/>/g, '>')); - // throw new Error('Found unsafe html'); - // } + + const safeHtml: string = sanitizeHtml(rawHtml, htmlSanitizeOptions); + // Revert some escaped characters for comparison. + if (comparableSanitizedHtml(rawHtml) === comparableSanitizedHtml(safeHtml)) { + return safeHtml; + } else { + console.debug('Rejected unsafe md:', md); + console.error('Rejected unsafe html:', rawHtml); + console.error('Rejected unsafe html:', comparableSanitizedHtml(rawHtml)); + console.error('Expected safe html:', comparableSanitizedHtml(safeHtml)); + throw new Error('Found unsafe html'); + } } export function analyzeSignature(