@knime/utils 1.5.9 → 1.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/package.json +2 -1
- package/src/index.ts +2 -0
- package/src/sanitization.ts +60 -0
package/CHANGELOG.md
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@knime/utils",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.6.0",
|
|
4
4
|
"description": "Internal utility functions and constants shared across @knime packages.",
|
|
5
5
|
"homepage": "https://knime.github.io/webapps-common/",
|
|
6
6
|
"license": "GPL 3 and Additional Permissions according to Sec. 7 (SEE the file LICENSE)",
|
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
"dependencies": {
|
|
10
10
|
"date-fns": "2.30.0",
|
|
11
11
|
"date-fns-tz": "2.0.0",
|
|
12
|
+
"dompurify": "^3.2.7",
|
|
12
13
|
"@knime/styles": "1.14.0"
|
|
13
14
|
},
|
|
14
15
|
"peerDependencies": {
|
package/src/index.ts
CHANGED
|
@@ -25,6 +25,7 @@ import getLocalTimeZone from "./localTimezone";
|
|
|
25
25
|
import * as navigatorUtils from "./navigator";
|
|
26
26
|
import numIntegerDigits from "./numIntegerDigits";
|
|
27
27
|
import * as promise from "./promise";
|
|
28
|
+
import { sanitization } from "./sanitization";
|
|
28
29
|
import sleep from "./sleep";
|
|
29
30
|
import truncateString from "./truncateString";
|
|
30
31
|
import updateDate from "./updateDate";
|
|
@@ -72,4 +73,5 @@ export {
|
|
|
72
73
|
truncateString,
|
|
73
74
|
updateDate,
|
|
74
75
|
updateTime,
|
|
76
|
+
sanitization,
|
|
75
77
|
};
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
import DomPurify from "dompurify";
|
|
2
|
+
|
|
3
|
+
const ALLOWED_TAGS = [
|
|
4
|
+
"p",
|
|
5
|
+
"div",
|
|
6
|
+
"h1",
|
|
7
|
+
"h2",
|
|
8
|
+
"h3",
|
|
9
|
+
"h4",
|
|
10
|
+
"h5",
|
|
11
|
+
"h6",
|
|
12
|
+
"ul",
|
|
13
|
+
"ol",
|
|
14
|
+
"li",
|
|
15
|
+
"blockquote",
|
|
16
|
+
"b",
|
|
17
|
+
"i",
|
|
18
|
+
"s",
|
|
19
|
+
"u",
|
|
20
|
+
"sup",
|
|
21
|
+
"sub",
|
|
22
|
+
"ins",
|
|
23
|
+
"del",
|
|
24
|
+
"strong",
|
|
25
|
+
"strike",
|
|
26
|
+
"tt",
|
|
27
|
+
"code",
|
|
28
|
+
"big",
|
|
29
|
+
"small",
|
|
30
|
+
"br",
|
|
31
|
+
"span",
|
|
32
|
+
"em",
|
|
33
|
+
];
|
|
34
|
+
|
|
35
|
+
/**
|
|
36
|
+
* Sanitizes Raw HTML and only allow specific tags to be used, as per OWASP standards.
|
|
37
|
+
* @param rawHTML
|
|
38
|
+
* @returns sanitized html
|
|
39
|
+
*/
|
|
40
|
+
const sanitizeHTML = (
|
|
41
|
+
rawHTML: string,
|
|
42
|
+
options: { allowStyleAttribute: boolean } = { allowStyleAttribute: false },
|
|
43
|
+
) => {
|
|
44
|
+
const { allowStyleAttribute } = options;
|
|
45
|
+
const ALLOWED_ATTR = allowStyleAttribute ? ["style"] : [];
|
|
46
|
+
|
|
47
|
+
return DomPurify.sanitize(rawHTML, { ALLOWED_TAGS, ALLOWED_ATTR });
|
|
48
|
+
};
|
|
49
|
+
|
|
50
|
+
/**
|
|
51
|
+
* Removes any HTML tag from the input string. Keeps HTML entities
|
|
52
|
+
* (e.g because these can be considered plain text)
|
|
53
|
+
* @param rawHTML
|
|
54
|
+
* @returns plain text
|
|
55
|
+
*/
|
|
56
|
+
const stripHTML = (rawHTML: string) => {
|
|
57
|
+
return DomPurify.sanitize(rawHTML, { ALLOWED_TAGS: [], ALLOWED_ATTR: [] });
|
|
58
|
+
};
|
|
59
|
+
|
|
60
|
+
export const sanitization = { sanitizeHTML, stripHTML };
|