@eclipse-docks/core 0.7.125 → 0.7.126

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eclipse-docks/core",
-  "version": "0.7.125",
+  "version": "0.7.126",
   "description": "Eclipse Docks platform core: registries, services, parts, widgets, and API",
   "type": "module",
   "license": "EPL-2.0",
@@ -77,6 +77,7 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
+    "dompurify": "^3.2.7",
     "@awesome.me/webawesome": "^3.12.0",
     "@fortawesome/fontawesome-free": "^7.2.0",
     "@fortawesome/fontawesome-svg-core": "^7.2.0",

package/src/api/services.ts

@@ -70,4 +70,5 @@ export {
 } from '../core/contribution-mapping';
 export { parseIconSpec, icon } from '../core/icon-utils';
 export type { ParsedIconSpec, IconOptions } from '../core/icon-utils';
+export { sanitizeHtml, parseMarkdownHtml } from '../core/markdown-html';
 

package/src/components/release-history.ts

@@ -1,9 +1,9 @@
 import { html, css } from "lit";
 import { customElement, state } from "lit/decorators.js";
 import { unsafeHTML } from "lit/directives/unsafe-html.js";
-import { marked } from "marked";
 import { DocksPart } from "../parts/part";
 import { appLoaderService, type ReleaseEntry } from "../core/apploader";
+import { parseMarkdownHtml } from "../core/markdown-html";
 import { createLogger } from "../core/logger";
 
 const logger = createLogger("ReleaseHistory");
@@ -112,9 +112,7 @@ export class DocksReleaseHistory extends DocksPart {
         const showUpdateHint = !isCurrent && isNewerThan(release.tag_name, this.appVersion);
         const atOldest = this.currentReleaseIndex === this.releases.length - 1;
         const atNewest = this.currentReleaseIndex === 0;
-        const bodyHtml = release.body
-            ? (marked.parse(release.body, { async: false }) as string)
-            : "";
+        const bodyHtml = release.body ? parseMarkdownHtml(release.body) : "";
 
         return html`
             <div class="release-panel">

package/src/core/markdown-html.ts

@@ -0,0 +1,11 @@
+import DOMPurify from 'dompurify';
+import { marked, type MarkedOptions } from 'marked';
+
+export function sanitizeHtml(html: string): string {
+    return DOMPurify.sanitize(html);
+}
+
+export function parseMarkdownHtml(markdown: string, options?: MarkedOptions): string {
+    const html = marked.parse(markdown, { async: false, ...options }) as string;
+    return sanitizeHtml(html);
+}

package/src/parts/dialog-content.ts

@@ -1,6 +1,6 @@
 import { html, TemplateResult, css } from "lit";
 import { unsafeHTML } from "lit/directives/unsafe-html.js";
-import { marked } from "marked";
+import { parseMarkdownHtml } from "../core/markdown-html";
 import { DocksElement } from "./element";
 
 export abstract class DocksDialogContent extends DocksElement {
@@ -22,7 +22,7 @@ export abstract class DocksDialogContent extends DocksElement {
 
     protected renderMessage(message: string, markdown: boolean = false): TemplateResult {
         if (markdown) {
-            const htmlContent = marked.parse(message, { async: false }) as string;
+            const htmlContent = parseMarkdownHtml(message);
             return html`<div class="dialog-message" style="white-space: normal;">${unsafeHTML(htmlContent)}</div>`;
         }
         return html`<div class="dialog-message" style="white-space: pre-line;">${message}</div>`;