@instructure/platform-sanitize 0.4.0 → 0.5.0

package/dist/index.js

@@ -1,5 +1,5 @@
-import d from "dompurify";
-const m = /* @__PURE__ */ new Set([
+import f from "dompurify";
+const w = /* @__PURE__ */ new Set([
   // layout
   "display",
   "float",
@@ -241,7 +241,7 @@ const m = /* @__PURE__ */ new Set([
   "caret-color",
   "accent-color",
   "appearance"
-]), w = /* @__PURE__ */ new Set([
+]), h = /* @__PURE__ */ new Set([
   "src",
   "href",
   "action",
@@ -252,7 +252,7 @@ const m = /* @__PURE__ */ new Set([
   "cite",
   "longdesc",
   "xlink:href"
-]), h = ["content"], y = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, A = /* @__PURE__ */ new Set([
+]), y = ["content"], A = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, k = /* @__PURE__ */ new Set([
   "allow-downloads",
   "allow-forms",
   "allow-modals",
@@ -265,8 +265,41 @@ const m = /* @__PURE__ */ new Set([
   "allow-scripts",
   "allow-storage-access-by-user-activation",
   "allow-top-navigation-by-user-activation"
-]), f = {
-  ADD_TAGS: ["iframe"],
+]), p = {
+  // semantics and annotation are re-allowed because DOMPurify blocks all of
+  // mathMlDisallowed by default. semantics is a safe structural wrapper;
+  // annotation carries LaTeX source text (e.g. \frac{1}{2}); Canvas emits
+  // text-only content here, and any child elements would be hoisted out of
+  // the MathML context and sanitized as ordinary HTML.
+  //
+  // annotation-xml is re-added here and filtered by an afterSanitizeElements
+  // hook below: it is stripped when its encoding makes it an HTML integration
+  // point ("text/html" or "application/xhtml+xml" per the WHATWG spec), which
+  // is the mXSS namespace-confusion vector. Semantic encodings used by external
+  // tools (MathML-Content, MathML-Presentation from MathType/Wolfram Alpha,
+  // application/x-tex, …) are not integration points and are preserved, so this
+  // layer no longer strips the benign annotation-xml the backend and TinyMCE
+  // already allow.
+  // object/embed/param re-enable PDF/SVG/media embedding in course content
+  // (e.g. <object data="file.pdf" type="application/pdf">). Their Flash/ActiveX
+  // attributes (classid, codebase, pluginspage, wmode, allowscriptaccess) are
+  // intentionally NOT added — dead tech, and ADD_ATTR is global in DOMPurify so
+  // re-allowing them would also reopen that surface on iframe. DOMPurify's URI
+  // filter blocks javascript:/data: on data/src, matching Canvas's
+  // http/https/relative protocol rule for these tags.
+  //
+  // SECURITY ASSUMPTION (same one iframe already relies on): object/embed load
+  // their resource as a *document*, not an image — a same-origin SVG/HTML file
+  // (e.g. <object data="/files/123/download" type="image/svg+xml">) executes any
+  // <script> it contains in the embedding page's origin. The javascript:/data:
+  // filter does not help here because the URL is a benign same-origin path; the
+  // payload lives in the fetched file. This is NOT new attack surface: <iframe>
+  // is already allowed and has the identical capability (its srcdoc is stripped —
+  // see test). The defense for all three is that Canvas serves user-uploaded
+  // files from a separate sandboxed origin. object/embed also have no usable
+  // sandbox attribute, so the sandbox-token hook cannot constrain them — again,
+  // parity with an unsandboxed iframe, which is already permitted.
+  ADD_TAGS: ["iframe", "semantics", "annotation", "annotation-xml", "object", "embed", "param"],
   ADD_ATTR: [
     "allowfullscreen",
     "allow",
@@ -274,6 +307,12 @@ const m = /* @__PURE__ */ new Set([
     "sandbox",
     "data-media-id",
     "data-media-type",
+    // <object>'s resource URL attribute — not in DOMPurify's defaults. src/type/
+    // name/value/width/height (used by object/embed/param) already are. Added
+    // globally (DOMPurify has no per-tag attr scoping), which is harmless: `data`
+    // is in URL_ATTRS so it is protocol-filtered, and it is not a DOM-clobbering
+    // or URI-safe attribute name.
+    "data",
     // RCE produces target="_blank" for external links. Modern browsers treat
     // target="_blank" as implicit rel="noopener", and the backend allowlist
     // already includes target.
@@ -310,17 +349,18 @@ const m = /* @__PURE__ */ new Set([
   // confusion attacks where fragments like <svg> could influence parse context.
   FORCE_BODY: !0
 };
-let a = null;
-function k() {
-  return a || (a = typeof d == "function" ? d(window) : d, a.addHook("afterSanitizeAttributes", (r) => {
-    if (!(r instanceof Element) || !r.hasAttribute("style")) return;
-    const t = r.style, e = [];
-    for (let n = 0; n < t.length; n++) {
-      const s = t.item(n);
-      m.has(s) || e.push(s);
+let n = null;
+function E() {
+  if (n) return n;
+  n = typeof f == "function" ? f(window) : f, n.addHook("afterSanitizeAttributes", (t) => {
+    if (!(t instanceof Element) || !t.hasAttribute("style")) return;
+    const e = t.style, r = [];
+    for (let i = 0; i < e.length; i++) {
+      const l = e.item(i);
+      w.has(l) || r.push(l);
     }
-    for (const n of e) t.removeProperty(n);
-    const o = /* @__PURE__ */ new Set([
+    for (const i of r) e.removeProperty(i);
+    const s = /* @__PURE__ */ new Set([
       "static",
       "relative",
       "absolute",
@@ -329,53 +369,63 @@ function k() {
       "unset",
       "revert",
       "revert-layer"
-    ]), l = t.getPropertyValue("position").trim().toLowerCase();
-    l && !o.has(l) && t.removeProperty("position");
-    const u = /* @__PURE__ */ new Set(["initial", "inherit", "unset", "revert", "revert-layer"]), i = t.getPropertyValue("opacity").trim().toLowerCase();
-    i && !u.has(i) && (i.endsWith("%") ? parseFloat(i) / 100 : parseFloat(i)) < 0.05 && t.removeProperty("opacity");
-    for (const n of h) {
-      const s = t.getPropertyValue(n);
-      s && y.test(s) && t.removeProperty(n);
+    ]), c = e.getPropertyValue("position").trim().toLowerCase();
+    c && !s.has(c) && e.removeProperty("position");
+    const d = /* @__PURE__ */ new Set(["initial", "inherit", "unset", "revert", "revert-layer"]), o = e.getPropertyValue("opacity").trim().toLowerCase();
+    o && !d.has(o) && (o.endsWith("%") ? parseFloat(o) / 100 : parseFloat(o)) < 0.05 && e.removeProperty("opacity");
+    for (const i of y) {
+      const l = e.getPropertyValue(i);
+      l && A.test(l) && e.removeProperty(i);
     }
-    t.length === 0 && r.removeAttribute("style");
-  }), a.addHook("uponSanitizeAttribute", (r, t) => {
-    if (!w.has(t.attrName)) return;
-    const e = t.attrValue;
-    /^\s*\/\//.test(e) ? (t.attrValue = e.trimStart().replace(/^\/\//, "https://"), t.keepAttr = !0) : /^\s*\\/.test(e) && (t.keepAttr = !1);
-  }), a.addHook("afterSanitizeAttributes", (r) => {
-    if (!(r instanceof Element) || !r.hasAttribute("srcset")) return;
-    const e = (r.getAttribute("srcset") ?? "").split(","), o = (i) => i.trim().split(/\s+/)[0];
-    if (e.some((i) => /^\s*\\/.test(o(i)))) {
-      r.removeAttribute("srcset");
+    e.length === 0 && t.removeAttribute("style");
+  }), n.addHook("uponSanitizeAttribute", (t, e) => {
+    if (!h.has(e.attrName)) return;
+    const r = e.attrValue;
+    /^\s*\/\//.test(r) ? (e.attrValue = r.trimStart().replace(/^\/\//, "https://"), e.keepAttr = !0) : /^\s*\\/.test(r) && (e.keepAttr = !1);
+  }), n.addHook("afterSanitizeAttributes", (t) => {
+    if (!(t instanceof Element) || !t.hasAttribute("srcset")) return;
+    const r = (t.getAttribute("srcset") ?? "").split(","), s = (o) => o.trim().split(/\s+/)[0];
+    if (r.some((o) => /^\s*\\/.test(s(o)))) {
+      t.removeAttribute("srcset");
       return;
     }
-    let l = !1;
-    const u = e.map((i) => {
-      const n = o(i);
-      if (!n.startsWith("//")) return i;
-      l = !0;
-      const s = i.indexOf(n);
-      return i.slice(0, s) + "https://" + n.slice(2) + i.slice(s + n.length);
+    let c = !1;
+    const d = r.map((o) => {
+      const i = s(o);
+      if (!i.startsWith("//")) return o;
+      c = !0;
+      const l = o.indexOf(i);
+      return o.slice(0, l) + "https://" + i.slice(2) + o.slice(l + i.length);
     });
-    l && r.setAttribute("srcset", u.join(","));
-  }), a.addHook("afterSanitizeAttributes", (r) => {
-    var o;
-    if (!(r instanceof Element) || r.tagName !== "A" && r.tagName !== "AREA" || ((o = r.getAttribute("target")) == null ? void 0 : o.toLowerCase()) !== "_blank") return;
-    const t = r.getAttribute("rel") ?? "", e = new Set(t.split(/\s+/).filter(Boolean));
-    e.add("noopener"), r.setAttribute("rel", [...e].join(" "));
-  }), a.addHook("afterSanitizeAttributes", (r) => {
-    if (!(r instanceof Element) || r.tagName !== "IFRAME" || !r.hasAttribute("sandbox")) return;
-    const e = (r.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), o = e.filter((l) => A.has(l));
-    o.length !== e.length && r.setAttribute("sandbox", o.join(" "));
-  }), a);
+    c && t.setAttribute("srcset", d.join(","));
+  }), n.addHook("afterSanitizeAttributes", (t) => {
+    var s;
+    if (!(t instanceof Element) || t.tagName !== "A" && t.tagName !== "AREA" || ((s = t.getAttribute("target")) == null ? void 0 : s.toLowerCase()) !== "_blank") return;
+    const e = t.getAttribute("rel") ?? "", r = new Set(e.split(/\s+/).filter(Boolean));
+    r.add("noopener"), t.setAttribute("rel", [...r].join(" "));
+  }), n.addHook("afterSanitizeAttributes", (t) => {
+    if (!(t instanceof Element) || t.tagName !== "IFRAME" || !t.hasAttribute("sandbox")) return;
+    const r = (t.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), s = r.filter((c) => k.has(c));
+    s.length !== r.length && t.setAttribute("sandbox", s.join(" "));
+  }), n.addHook("afterSanitizeAttributes", (t) => {
+    if (!(t instanceof Element) || t.tagName !== "PARAM") return;
+    const e = t.getAttribute("value");
+    e && /^\s*(?:javascript|vbscript):/i.test(e) && t.removeAttribute("value");
+  });
+  const a = /* @__PURE__ */ new Set(["text/html", "application/xhtml+xml"]);
+  return n.addHook("afterSanitizeElements", (t) => {
+    if (!(t instanceof Element) || t.tagName.toLowerCase() !== "annotation-xml") return;
+    const e = (t.getAttribute("encoding") ?? "").toLowerCase().trim();
+    a.has(e) && t.remove();
+  }), n;
 }
-function v(r, t) {
+function R(a, t) {
   if (typeof window > "u")
     throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
-  const e = t != null && t.allowFormAttributeNames ? { ...f, SANITIZE_DOM: !1 } : f;
-  return k().sanitize(r ?? "", e);
+  const e = t != null && t.allowFormAttributeNames ? { ...p, SANITIZE_DOM: !1 } : p;
+  return E().sanitize(a ?? "", e);
 }
-const p = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), c = "http://platform-sanitize.invalid/", b = /^\s*\/\//, g = (
+const m = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), u = "http://platform-sanitize.invalid/", b = /^\s*\/\//, g = (
   // oxlint-disable-next-line no-control-regex -- intentional security guard
   /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
 ), S = {
@@ -391,49 +441,49 @@ const p = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), c = "
 `
   // java&NewLine;script:
 };
-function E(r) {
-  return r.replace(/&#(\d+);/g, (t, e) => {
-    const o = Number(e);
-    if (!Number.isFinite(o) || o < 0 || o > 1114111) return "";
+function x(a) {
+  return a.replace(/&#(\d+);/g, (t, e) => {
+    const r = Number(e);
+    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
     try {
-      return String.fromCodePoint(o);
+      return String.fromCodePoint(r);
     } catch {
       return "";
     }
   }).replace(/&#x([\da-f]+);/gi, (t, e) => {
-    const o = parseInt(e, 16);
-    if (!Number.isFinite(o) || o < 0 || o > 1114111) return "";
+    const r = parseInt(e, 16);
+    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
     try {
-      return String.fromCodePoint(o);
+      return String.fromCodePoint(r);
     } catch {
       return "";
     }
   }).replace(/&([A-Za-z][A-Za-z0-9]*);/g, (t, e) => S[e] ?? t);
 }
-function R(r) {
-  if (!r || !r.trim()) return "about:blank";
-  const t = r.replace(/\\/g, "/");
+function _(a) {
+  if (!a || !a.trim()) return "about:blank";
+  const t = a.replace(/\\/g, "/");
   if (b.test(t) || g.test(t)) return "about:blank";
   if (/&[#A-Za-z]/.test(t)) {
-    const e = E(t);
+    const e = x(t);
     if (b.test(e) || g.test(e))
       return "about:blank";
     try {
-      const o = new URL(e, c);
-      if (!o.href.startsWith(c) && !p.has(o.protocol))
+      const r = new URL(e, u);
+      if (!r.href.startsWith(u) && !m.has(r.protocol))
         return "about:blank";
     } catch {
       return "about:blank";
     }
   }
   try {
-    const e = new URL(t, c);
-    return !p.has(e.protocol) || (e.protocol === "http:" || e.protocol === "https:") && (e.username || e.password) ? "about:blank" : e.href.startsWith(c) ? r : t.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
+    const e = new URL(t, u);
+    return !m.has(e.protocol) || (e.protocol === "http:" || e.protocol === "https:") && (e.username || e.password) ? "about:blank" : e.href.startsWith(u) ? a : t.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
   } catch {
     return "about:blank";
   }
 }
 export {
-  v as sanitizeHtml,
-  R as sanitizeUrl
+  R as sanitizeHtml,
+  _ as sanitizeUrl
 };

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA6dA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAoiBA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",