@ecency/render-helper 2.3.12 → 2.3.13

package/lib/types/xss-white-list.interface.d.ts

@@ -2,4 +2,5 @@ import { IWhiteList } from 'xss';
 export interface XSSWhiteList extends IWhiteList {
     iframe?: string[];
     strike?: string[];
+    video?: string[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecency/render-helper",
-  "version": "2.3.12",
+  "version": "2.3.13",
   "description": "Markdown+Html Render helper",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/consts/allowed-attributes.const.ts

@@ -33,6 +33,7 @@ export const ALLOWED_ATTRIBUTES: XSSWhiteList = {
   ],
   'span': ['class', 'id'],
   'iframe': ['src', 'class', 'frameborder', 'allowfullscreen', 'webkitallowfullscreen', 'mozallowfullscreen', 'sandbox'],
+  'video': ['src', 'controls', 'poster'],
   'div': ['class', 'id'],
   'strong': [],
   'b': [],

package/src/methods/sanitize-html.method.ts

@@ -17,6 +17,10 @@ export function sanitizeHtml(html: string): string {
 
       if (name.startsWith('on')) return ''; // 🛡 event handlers
       if (tag === 'img' && name === 'src' && (!/^https?:\/\//.test(decoded) || decoded.startsWith('javascript:'))) return '';
+      if (
+        tag === 'video' && ['src', 'poster'].includes(name) &&
+        (!/^https?:\/\//.test(decoded) || decoded.startsWith('javascript:'))
+      ) return '';
       if (tag === 'img' && ['dynsrc', 'lowsrc'].includes(name)) return '';
       if (tag === 'span' && name === 'class' && value === 'wr') return '';
       if (name === 'id') {

package/src/sanitize-html.spec.ts

@@ -0,0 +1,15 @@
+import { sanitizeHtml } from './methods/sanitize-html.method'
+
+describe('sanitizeHtml', () => {
+  it('1- should allow video tag with src and controls', () => {
+    const input = '<video src="https://example.com/video.mp4" controls></video>'
+    const expected = '<video src="https://example.com/video.mp4" controls></video>'
+    expect(sanitizeHtml(input)).toBe(expected)
+  })
+
+  it('2- should strip dangerous video src', () => {
+    const input = "<video src=\"javascript:alert('XSS')\" controls></video>"
+    const expected = '<video controls></video>'
+    expect(sanitizeHtml(input)).toBe(expected)
+  })
+})

package/src/types/xss-white-list.interface.ts

@@ -3,4 +3,5 @@ import { IWhiteList } from 'xss'
 export interface XSSWhiteList extends IWhiteList {
   iframe?: string[]
   strike?: string[]
+  video?: string[]
 }