@knime/utils 1.9.1 → 1.9.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @knime/utils
 
+## 1.9.2
+
+### Patch Changes
+
+- 6d57731: Add option to allow hyperlinks to the sanitization util.
+
 ## 1.9.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knime/utils",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "Internal utility functions and constants shared across @knime packages.",
   "repository": {
     "type": "git",

package/src/sanitization.ts

@@ -35,16 +35,28 @@ const ALLOWED_TAGS = [
 /**
  * Sanitizes Raw HTML and only allow specific tags to be used, as per OWASP standards.
  * @param rawHTML
+ * @param options.allowStyleAttribute - Allow the style attribute on elements
+ * @param options.allowHyperlinks - Allow anchor tags with href attribute
  * @returns sanitized html
  */
 const sanitizeHTML = (
   rawHTML: string,
-  options: { allowStyleAttribute: boolean } = { allowStyleAttribute: false },
+  options: { allowStyleAttribute?: boolean; allowHyperlinks?: boolean } = {
+    allowStyleAttribute: false,
+    allowHyperlinks: false,
+  },
 ) => {
-  const { allowStyleAttribute } = options;
-  const ALLOWED_ATTR = allowStyleAttribute ? ["style"] : [];
+  const { allowStyleAttribute, allowHyperlinks } = options;
+  const ALLOWED_ATTR = [
+    ...(allowStyleAttribute ? ["style"] : []),
+    ...(allowHyperlinks ? ["href"] : []),
+  ];
+  const allowedTags = allowHyperlinks ? [...ALLOWED_TAGS, "a"] : ALLOWED_TAGS;
 
-  return DomPurify.sanitize(rawHTML, { ALLOWED_TAGS, ALLOWED_ATTR });
+  return DomPurify.sanitize(rawHTML, {
+    ALLOWED_TAGS: allowedTags,
+    ALLOWED_ATTR,
+  });
 };
 
 /**