ghost 4.48.2 → 4.48.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,15 +1,43 @@
1
1
  /* eslint indent: warn, no-irregular-whitespace: warn */
2
2
  const iff = (cond, yes, no) => (cond ? yes : no);
3
+ const sanitizeHtml = require('sanitize-html');
4
+
5
+ /**
6
+ * @template {Object.<string, any>} Input
7
+ * @param {Input} obj
8
+ * @param {string[]} [keys]
9
+ * @returns {Input}
10
+ */
11
+ const sanitizeKeys = (obj, keys) => {
12
+ const sanitized = Object.assign({}, obj);
13
+ const keysToSanitize = keys || Object.keys(obj);
14
+
15
+ for (const key of keysToSanitize) {
16
+ if (typeof sanitized[key] === 'string') {
17
+ // @ts-ignore
18
+ sanitized[key] = sanitizeHtml(sanitized[key], {
19
+ allowedTags: false,
20
+ allowedAttributes: false
21
+ });
22
+ }
23
+ }
24
+
25
+ return sanitized;
26
+ };
27
+
3
28
  module.exports = ({post, site, newsletter, templateSettings}) => {
4
29
  const date = new Date();
5
30
  const hasFeatureImageCaption = templateSettings.showFeatureImage && post.feature_image && post.feature_image_caption;
31
+ const cleanPost = sanitizeKeys(post, ['title', 'excerpt', 'html', 'feature_image_alt', 'feature_image_caption']);
32
+ const cleanSite = sanitizeKeys(site, ['title']);
33
+ const cleanNewsletter = sanitizeKeys(newsletter, ['name']);
6
34
  return `<!doctype html>
7
35
  <html>
8
36
 
9
37
  <head>
10
38
  <meta name="viewport" content="width=device-width" />
11
39
  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
12
- <title>${post.title}</title>
40
+ <title>${cleanPost.title}</title>
13
41
  <style>
14
42
  /* -------------------------------------
15
43
  GLOBAL RESETS
@@ -1137,7 +1165,7 @@ ${ templateSettings.showBadge ? `
1137
1165
  </head>
1138
1166
 
1139
1167
  <body>
1140
- <span class="preheader">${ post.excerpt ? post.excerpt : `${post.title} – ` }</span>
1168
+ <span class="preheader">${ cleanPost.excerpt ? cleanPost.excerpt : `${cleanPost.title} – ` }</span>
1141
1169
  <table role="presentation" border="0" cellpadding="0" cellspacing="0" class="body" width="100%">
1142
1170
 
1143
1171
  <!-- Outlook doesn't respect max-width so we need an extra centered table -->
@@ -1172,24 +1200,24 @@ ${ templateSettings.showBadge ? `
1172
1200
  <tr>
1173
1201
  <td class="${templateSettings.showHeaderTitle ? `site-info-bordered` : `site-info`}" width="100%" align="center">
1174
1202
  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
1175
- ${ templateSettings.showHeaderIcon && site.iconUrl ? `
1203
+ ${ templateSettings.showHeaderIcon && cleanSite.iconUrl ? `
1176
1204
  <tr>
1177
- <td class="site-icon"><a href="${site.url}"><img src="${site.iconUrl}" alt="${site.title}" border="0"></a></td>
1205
+ <td class="site-icon"><a href="${cleanSite.url}"><img src="${cleanSite.iconUrl}" alt="${cleanSite.title}" border="0"></a></td>
1178
1206
  </tr>
1179
1207
  ` : ``}
1180
1208
  ${ templateSettings.showHeaderTitle ? `
1181
1209
  <tr>
1182
- <td class="site-url ${!templateSettings.showHeaderName ? 'site-url-bottom-padding' : ''}"><div style="width: 100% !important;"><a href="${site.url}" class="site-title">${site.title}</a></div></td>
1210
+ <td class="site-url ${!templateSettings.showHeaderName ? 'site-url-bottom-padding' : ''}"><div style="width: 100% !important;"><a href="${cleanSite.url}" class="site-title">${cleanSite.title}</a></div></td>
1183
1211
  </tr>
1184
1212
  ` : ``}
1185
1213
  ${ templateSettings.showHeaderName && templateSettings.showHeaderTitle ? `
1186
1214
  <tr>
1187
- <td class="site-url site-url-bottom-padding"><div style="width: 100% !important;"><a href="${site.url}" class="site-subtitle">${newsletter.name}</a></div></td>
1215
+ <td class="site-url site-url-bottom-padding"><div style="width: 100% !important;"><a href="${cleanSite.url}" class="site-subtitle">${cleanNewsletter.name}</a></div></td>
1188
1216
  </tr>
1189
1217
  ` : ``}
1190
1218
  ${ templateSettings.showHeaderName && !templateSettings.showHeaderTitle ? `
1191
1219
  <tr>
1192
- <td class="site-url site-url-bottom-padding"><div style="width: 100% !important;"><a href="${site.url}" class="site-title">${newsletter.name}</a></div></td>
1220
+ <td class="site-url site-url-bottom-padding"><div style="width: 100% !important;"><a href="${cleanSite.url}" class="site-title">${cleanNewsletter.name}</a></div></td>
1193
1221
  </tr>
1194
1222
  ` : ``}
1195
1223
 
@@ -1201,7 +1229,7 @@ ${ templateSettings.showBadge ? `
1201
1229
 
1202
1230
  <tr>
1203
1231
  <td class="post-title ${templateSettings.titleFontCategory === 'serif' ? `post-title-serif` : `` } ${templateSettings.titleAlignment === 'left' ? `post-title-left` : ``}">
1204
- <a href="${post.url}" class="post-title-link ${templateSettings.titleAlignment === 'left' ? `post-title-link-left` : ``}">${post.title}</a>
1232
+ <a href="${cleanPost.url}" class="post-title-link ${templateSettings.titleAlignment === 'left' ? `post-title-link-left` : ``}">${cleanPost.title}</a>
1205
1233
  </td>
1206
1234
  </tr>
1207
1235
  <tr>
@@ -1209,28 +1237,28 @@ ${ templateSettings.showBadge ? `
1209
1237
  <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%">
1210
1238
  <tr>
1211
1239
  <td class="post-meta ${templateSettings.titleAlignment === 'left' ? `post-meta-left` : ``}">
1212
- By ${post.authors} –
1213
- ${post.published_at} –
1214
- <a href="${post.url}" class="view-online-link">View online →</a>
1240
+ By ${cleanPost.authors} –
1241
+ ${cleanPost.published_at} –
1242
+ <a href="${cleanPost.url}" class="view-online-link">View online →</a>
1215
1243
  </td>
1216
1244
  </tr>
1217
1245
  </table>
1218
1246
  </td>
1219
1247
  </tr>
1220
- ${ templateSettings.showFeatureImage && post.feature_image ? `
1248
+ ${ templateSettings.showFeatureImage && cleanPost.feature_image ? `
1221
1249
  <tr>
1222
- <td class="feature-image ${hasFeatureImageCaption ? 'feature-image-with-caption' : ''}"><img src="${post.feature_image}"${post.feature_image_width ? ` width="${post.feature_image_width}"` : ''}${post.feature_image_alt ? ` alt="${post.feature_image_alt}"` : ''}></td>
1250
+ <td class="feature-image ${hasFeatureImageCaption ? 'feature-image-with-caption' : ''}"><img src="${cleanPost.feature_image}"${cleanPost.feature_image_width ? ` width="${cleanPost.feature_image_width}"` : ''}${cleanPost.feature_image_alt ? ` alt="${cleanPost.feature_image_alt}"` : ''}></td>
1223
1251
  </tr>
1224
1252
  ` : ``}
1225
1253
  ${ hasFeatureImageCaption ? `
1226
1254
  <tr>
1227
- <td class="feature-image-caption" align="center">${post.feature_image_caption}</td>
1255
+ <td class="feature-image-caption" align="center">${cleanPost.feature_image_caption}</td>
1228
1256
  </tr>
1229
1257
  ` : ``}
1230
1258
  <tr>
1231
1259
  <td class="${(templateSettings.bodyFontCategory === 'sans_serif') ? `post-content-sans-serif` : `post-content` }">
1232
1260
  <!-- POST CONTENT START -->
1233
- ${post.html}
1261
+ ${cleanPost.html}
1234
1262
  <!-- POST CONTENT END -->
1235
1263
  </td>
1236
1264
  </tr>
@@ -1245,7 +1273,7 @@ ${ templateSettings.showBadge ? `
1245
1273
  <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="padding-top: 40px; padding-bottom: 30px;">
1246
1274
  ${iff(!!templateSettings.footerContent, `<tr><td class="footer">${templateSettings.footerContent}</td></tr>`, '')}
1247
1275
  <tr>
1248
- <td class="footer">${site.title} &copy; ${date.getFullYear()} – <a href="%recipient.unsubscribe_url%">Unsubscribe</a></td>
1276
+ <td class="footer">${cleanSite.title} &copy; ${date.getFullYear()} – <a href="%recipient.unsubscribe_url%">Unsubscribe</a></td>
1249
1277
  </tr>
1250
1278
 
1251
1279
  ${ templateSettings.showBadge ? `
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ghost",
3
- "version": "4.48.2",
3
+ "version": "4.48.3",
4
4
  "description": "The professional publishing platform",
5
5
  "author": "Ghost Foundation",
6
6
  "homepage": "https://ghost.org",