@tiledesk/tiledesk-server 2.10.101 → 2.10.102

package/CHANGELOG.md

@@ -5,6 +5,9 @@
 🚀        IN PRODUCTION                        🚀
 (https://www.npmjs.com/package/@tiledesk/tiledesk-server/v/2.3.77) 
 
+# 2.10.102
+- Update: substituted encode with DOMPurify.sanitize for direct email
+
 # 2.10.101
 - Update: messenger-connector to 0.1.27
 - Update: multi-worker to 0.3.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tiledesk/tiledesk-server",
   "description": "The Tiledesk server module",
-  "version": "2.10.101",
+  "version": "2.10.102",
   "scripts": {
     "start": "node ./bin/www",
     "pretest": "mongodb-runner start",
@@ -45,16 +45,15 @@
     "@tiledesk/tiledesk-json-rules-engine": "^4.0.3",
     "@tiledesk/tiledesk-kaleyra-proxy": "^0.1.7",
     "@tiledesk/tiledesk-messenger-connector": "^0.1.27",
+    "@tiledesk/tiledesk-multi-worker": "^0.3.3",
     "@tiledesk/tiledesk-rasa-connector": "^1.0.10",
+    "@tiledesk/tiledesk-sms-connector": "^0.1.11",
     "@tiledesk/tiledesk-telegram-connector": "^0.1.14",
     "@tiledesk/tiledesk-tybot-connector": "^2.0.19",
+    "@tiledesk/tiledesk-voice-twilio-connector": "^0.1.22",
+    "@tiledesk/tiledesk-vxml-connector": "^0.1.76",
     "@tiledesk/tiledesk-whatsapp-connector": "^0.1.84",
     "@tiledesk/tiledesk-whatsapp-jobworker": "^0.0.12",
-    "@tiledesk/tiledesk-sms-connector": "^0.1.11",
-    "@tiledesk/tiledesk-vxml-connector": "^0.1.76",
-    "@tiledesk/tiledesk-voice-twilio-connector": "^0.1.22",
-    "@tiledesk/tiledesk-multi-worker": "^0.3.3",
-    "passport-oauth2": "^1.8.0",
     "amqplib": "^0.5.5",
     "app-root-path": "^3.0.0",
     "bcrypt-nodejs": "0.0.3",
@@ -65,6 +64,7 @@
     "cors": "^2.8.5",
     "csv-express": "^1.2.2",
     "debug": "^4.3.4",
+    "dompurify": "^3.2.6",
     "dotenv": "^8.6.0",
     "email-templates": "^8.1.0",
     "eventemitter2": "^6.4.4",
@@ -82,6 +82,7 @@
     "immutable": "^4.1.0",
     "jade": "~1.11.0",
     "jobs-worker-queued": "^0.0.5",
+    "jsdom": "^26.1.0",
     "jsonwebtoken": "^8.5.1",
     "lodash": "^4.17.21",
     "marked": "^3.0.4",
@@ -104,6 +105,7 @@
     "passport-google-oidc": "^0.1.0",
     "passport-http": "^0.3.0",
     "passport-jwt": "^4.0.0",
+    "passport-oauth2": "^1.8.0",
     "pdfmake": "^0.2.5",
     "promise-events": "^0.2.4",
     "request": "^2.88.2",

package/services/emailService.js

@@ -9,6 +9,11 @@ var handlebars = require('handlebars');
 var encode = require('html-entities').encode;
 const emailEvent = require('../event/emailEvent');
 
+const createDOMPurify = require('dompurify');
+const { JSDOM } = require('jsdom');
+const window = new JSDOM('').window;
+const DOMPurify = createDOMPurify(window);
+
 handlebars.registerHelper('ifEquals', function (arg1, arg2, options) {
   return (arg1 == arg2) ? options.fn(this) : options.inverse(this);
 });
@@ -1476,13 +1481,15 @@ class EmailService {
     var baseScope = JSON.parse(JSON.stringify(that));
     delete baseScope.pass;
 
-
     let msgText = text;
-    msgText = encode(msgText);
     if (this.markdown) {
       msgText = marked(msgText);
+      msgText = DOMPurify.sanitize(msgText);
+    } else {
+      msgText = encode(msgText);
     }
 
+
     winston.debug("msgText: " + msgText);
     winston.debug("baseScope: " + JSON.stringify(baseScope));
 

package/test/emailService.js

@@ -0,0 +1,43 @@
+//During the test the env variable is set to test
+process.env.NODE_ENV = 'test';
+
+var expect = require('chai').expect;
+
+var assert = require('chai').assert;
+var config = require('../config/database');
+var mongoose = require('mongoose');
+var winston = require('../config/winston');
+
+mongoose.connect(config.databasetest);
+
+var projectService = require("../services/projectService");
+const emailService = require('../services/emailService');
+
+let log = false;
+
+describe('EmailService', function () {
+
+
+  it('direct', function (done) {
+    var userid = "5badfe5d553d1844ad654072";
+    projectService.create("test1", userid).then(function (savedProject) {
+      // create(fullname, email, id_project, createdBy)
+
+      let request_id = "support-group-" + savedProject._id + "-123456";
+
+      //let text = "this is\n<b>the</b>\ntext";
+      //let text = 'this is <script>alert("XSS")</script>';
+      let text = 'Go to [Google](https://google.com)';
+      emailService.sendEmailDirect("my@email.com", text, savedProject._id, request_id, "Suubject").then((response) => {
+        console.log("response: ", response);
+        done();
+      }).catch((err) => {
+        console.error("err: ", err)
+        done();
+      })
+
+      
+    });
+  });
+
+});