@capillarytech/cap-ui-utils 1.4.24 → 1.4.25-alpha.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capillarytech/cap-ui-utils",
-  "version": "1.4.24",
+  "version": "1.4.25-alpha.0",
   "description": "Utility functions shared accross all the modules",
   "main": "index.js",
   "scripts": {

package/utils/sanitizeEmailTemplate.js

@@ -0,0 +1,71 @@
+import { JSDOM } from 'jsdom';
+import createDOMPurify from 'dompurify';
+import isEmpty from 'lodash/isEmpty';
+
+export const sanitizeTemplateWithDomPurify = (content) => {
+    const window = new JSDOM('<textarea id="a1" />').window;
+    const textElement = window.document.getElementById("a1");
+    textElement.innerHTML = content;
+    const DOMPurify = createDOMPurify(window);
+    return DOMPurify.sanitize(content);
+};
+
+
+export const sanitizeTemplateWithRegexp = (content) => {
+    const forbiddenTags = process.env.TMPL_SANITIZE_FORBIDDEN_TAGS ? JSON.parse(process.env.TMPL_SANITIZE_FORBIDDEN_TAGS) : ['script'];
+    const forbiddenAttrs = process.env.TMPL_SANITIZE_FORBIDDEN_ATTRS ? JSON.parse(process.env.TMPL_SANITIZE_FORBIDDEN_ATTRS) : ['onclick', 'onmouseover', 'onmouseout'];
+    const forbiddenHrefJavaScript = ["javascript:"];
+    const tagsJoined = forbiddenTags.join('|');
+    const attrsJoined = forbiddenAttrs.join('|');
+    const hrefsJoined = forbiddenHrefJavaScript.join('|');
+    const fullTagRegex = new RegExp(`<${tagsJoined}\\b[^<]*(?:(?!<\/${tagsJoined}>)<[^<]*)*<\/${tagsJoined}>`, 'gi');
+    const emptyTagRegex = new RegExp(`<${tagsJoined}.*\/?>`, 'gi');
+    const attrRegex = new RegExp(`\\b(${attrsJoined})\\s*=\\s*(\"[^\"]*\"|'[^']*'|[^>|&|\/\\s]+)`, 'gi');
+    const hrefJavaScriptRegex = new RegExp(`href\\s*=\\s*(["\'])(?:\\*?.)*?(?:\\?\\")?${hrefsJoined}(?:\\\\?.)*?\\1`, 'gi');
+    const hrefRegexForJsonString = new RegExp(`href=\\\\["\']${hrefsJoined}.*?\\\\["\']`, 'gi');  // This is to find the href in json format for BEE editor
+    const encodedScriptTagRegex = new RegExp(`(?:<|&lt;)${tagsJoined}(?:\s[^>]*|)[^*]*&gt;`, 'gi');
+
+    return content
+      .replaceAll(fullTagRegex, '')
+      .replaceAll(encodedScriptTagRegex, '')
+      .replaceAll(emptyTagRegex, '')
+      .replaceAll(attrRegex, '')
+      .replaceAll(hrefJavaScriptRegex, 'href="#"')
+      .replaceAll(hrefRegexForJsonString, 'href=\\\"#\\\"'); // This will ensure to remain the content in json format for BEE editor
+};
+
+export const sanitizeEmailTemplateAndSaveInData = data => {
+  var content = data?.versions?.base?.[data?.versions?.base?.activeTab]['template-content'];
+  var sanitizedContent = sanitizeTemplateWithRegexp(content);
+  const newData = {
+    ...data,
+    versions: {
+      ...data.versions,
+      base: {
+        ...data.versions.base,
+        [data.versions.base.activeTab]: {
+          ...data.versions.base[data.versions.base.activeTab],
+          'template-content': sanitizedContent
+        }
+      },
+      history: [{
+        ...data.versions.history[0],
+        [data.versions.history[0].activeTab]: {
+          ...data.versions.history[0][data.versions.history[0].activeTab],
+          'template-content': sanitizedContent
+        }
+      }]
+    },
+  }
+
+  // To handle in BEE editor. // is_drag_drop=true means BEE editor is enabled
+  if (data?.versions?.base?.[data?.versions?.base?.activeTab]?.is_drag_drop) {
+    const jsonContent = data?.versions?.base?.[data?.versions?.base?.activeTab]?.['json-content'];
+    if (!isEmpty(jsonContent)) {
+      const sanitizedJsonContent = sanitizeTemplateWithRegexp(jsonContent);
+      newData.versions.base[newData?.versions?.base?.activeTab]['json-content'] = sanitizedJsonContent;
+      newData.versions.history[0][newData?.versions?.history?.[0]?.activeTab]['json-content'] = sanitizedJsonContent;
+    }
+  }
+  return { sanitizedContent, newData };
+};