@happeouikit/content-renderer 3.0.0 → 3.0.1

package/CHANGELOG.md

@@ -1,9 +1,14 @@
 # Changelog
 
+## 3.0.1
+
+- [Fixed] ContentRenderer should now deal with all kinds of xss
+
 ## 3.0.0
 
 - [Fixed] the xss converter now accepts a whiteList for CSS properties that includes vertical-align
 - [Updated] new dependencies updates: React 17 and and Styled Components 5
+
 ## 2.0.1
 
 - [Added] Changed type to uppercase and to handle both upper and lowercase. Add warning if lowecase is used.

package/dist/ContentRenderer.js

@@ -68,7 +68,7 @@ import { CopyToClipboardButton } from "@happeouikit/copy-to-clipboard-button";
 import { BodyUI, sansFamily } from "@happeouikit/typography";
 import { margin200, media, padding200 } from "@happeouikit/layout";
 import { active, gray04, gray07, gray09, lighten, warn } from "@happeouikit/colors";
-import { toHtml, toSafeText, loadCodeFont, decodeHtmlEntities, removeSpecialCharacters } from "./utils";
+import { toHtml, loadCodeFont, decodeHtmlEntities, removeSpecialCharacters, toSafeText } from "./utils";
 import { ELEMENT_TYPE_PRE, ELEMENT_TYPE_CODE, HIGHLIGHJS_CSS, HIGHLIGHJS_JS, CODE_BLOCK_AVAILABLE_LANGUAGES } from "./constants";
 import { jsx as _jsx } from "react/jsx-runtime";
 import { Fragment as _Fragment } from "react/jsx-runtime";
@@ -177,13 +177,13 @@ var ContentRenderer = function ContentRenderer(_ref) {
   }, [element, createAnchors, useHashAutoscroll, scrollAndHighlightHash]);
   var safeText = useMemo(function () {
     var lowercaseType = type && typeof type === "string" ? type.toLowerCase() : "html";
-    var transformedContent = lowercaseType === "text" ? "<p>".concat(content, "</p>") : toHtml(content, lowercaseType);
+    var transformedContent = lowercaseType === "text" ? toSafeText("<p>".concat(content, "</p>")) : toHtml(content, lowercaseType);
 
     if (decodeHtmlEntitiesOnRender) {
       transformedContent = decodeHtmlEntities(transformedContent);
     }
 
-    return toSafeText(transformedContent);
+    return transformedContent;
   }, [content, type, decodeHtmlEntitiesOnRender]); // Use dangerouslySetInnerHTML as there might be nested <p>'s header etc
   // This requires that all content is run through the toSafeText filter
   // before displaying. This will run it through xss filter.

package/dist/utils.js

@@ -28,6 +28,26 @@ var processMentions = function processMentions() {
   var str = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : "";
   return str.replace(mentioningRegexGroupCaseInsensitive, processMatch).replace(mentioningHtmlRegexGroupCaseInsensitive, processMatch);
 };
+/**
+ * @name toSafeText
+ * @description Returns filtered text with filterXSS library
+ * @author Antero Hanhirova
+ * @param {String} - Text to whitelist
+ * @returns {String}
+ */
+
+
+var toSafeText = function toSafeText(text) {
+  return xss(text, {
+    whiteList: safeTagsAndAttributes,
+    css: {
+      whiteList: _objectSpread({}, xss.getDefaultCSSWhiteList(), {
+        "vertical-align": true
+      })
+    },
+    stripIgnoreTag: true
+  }).replace(/ /g, " ").replace(/\u2060/g, ""); // Replaces a hidden character that resulted in a "?"-character in backend
+};
 /**
  * @name toHtml
  * @description Converts markdown to html, adds space to end of String
@@ -50,31 +70,12 @@ var toHtml = function toHtml() {
     newString = processMentions(newString);
   }
 
+  newString = toSafeText(newString);
   return linkifyHtml(newString, {
     target: "_blank",
     ignoreTags: ["pre", "code", "script", "style"]
   });
 };
-/**
- * @name toSafeText
- * @description Returns filtered text with filterXSS library
- * @author Antero Hanhirova
- * @param {String} - Text to whitelist
- * @returns {String}
- */
-
-
-var toSafeText = function toSafeText(text) {
-  return xss(text, {
-    whiteList: safeTagsAndAttributes,
-    css: {
-      whiteList: _objectSpread({}, xss.getDefaultCSSWhiteList(), {
-        "vertical-align": true
-      })
-    },
-    stripIgnoreTag: true
-  }).replace(/ /g, " ").replace(/\u2060/g, ""); // Replaces a hidden character that resulted in a "?"-character in backend
-};
 
 var loadCodeFont = function loadCodeFont() {
   var id = "ibmMonoOnDemand";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happeouikit/content-renderer",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Rendering html and markdown content",
   "main": "dist/index.js",
   "module": "src/index.js",