@autobusal/utilities 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this package are documented here. This project follows [Keep a Changelog](https://keepachangelog.com/) and [Semantic Versioning](https://semver.org/).
 
+## [1.1.2] - 2026-07-24
+
+### Added
+
+- New `sanitizeHtml(html)` helper (wraps DOMPurify) for sanitizing admin-authored CMS content (pages, articles, notifications, policies, affiliate terms, document previews) before rendering via `dangerouslySetInnerHTML`. Added `dompurify` as a dependency.
+
 ## [1.1.1] - 2026-07-19
 
 ### Added

package/index.ts

@@ -6,8 +6,10 @@ import { getSex, getOptionsSex } from './passengers';
 import { GetStatus, GetEnvironment, DisplayStatus } from './users';
 import { getRandomNumber } from './numbers';
 import { getParams } from './manage';
+import { sanitizeHtml } from './sanitize';
 
 export {
+  sanitizeHtml,
   Validate,
   Display,
   error,

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@autobusal/utilities",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "author": "Ferjolt Ozuni",
   "type": "module",
-  "main": "index.ts"
+  "main": "index.ts",
+  "dependencies": {
+    "dompurify": "^3.4.12"
+  }
 }

package/sanitize.ts

@@ -0,0 +1,11 @@
+import DOMPurify from 'dompurify';
+
+// Sanitizes admin-authored HTML (CMS pages, articles, notifications, policies,
+// affiliate terms, document previews) before it's rendered via
+// dangerouslySetInnerHTML. These fields are only writable by an admin-type
+// account today, but rendering them unsanitized still means a compromised or
+// phished admin can persist JS that runs in every visitor's and every other
+// admin's browser - this is the defense-in-depth layer for that case.
+export const sanitizeHtml = (html: string | null | undefined): string => (
+  DOMPurify.sanitize(html ?? '')
+);