rimecms 0.23.9 → 0.23.11

package/dist/util/string.d.ts

@@ -87,6 +87,5 @@ export declare const isValidSlug: (str: string) => boolean;
  * Sanitizes user input by removing dangerous HTML tags while preserving allowed formatting tags,
  * this doesn't encode/decode HTML entities.
  * allowed tags : ['strong', 'b', 'em', 'i', 'u', 'br', 'a']
- * allowedAttributes : ['href', '_target']
  */
 export declare const sanitize: (value?: string) => string;

package/dist/util/string.js

@@ -1,5 +1,6 @@
+import { Parser } from '@thednp/domparser';
 import camelCase from 'camelcase';
-import sanitizeHtml from 'sanitize-html';
+let parser;
 /**
  * Capitalizes the first letter of a string.
  *
@@ -148,11 +149,12 @@ export const isValidSlug = (str) => /^[a-zA-Z][a-zA-Z0-9_-]*$/.test(str);
  * Sanitizes user input by removing dangerous HTML tags while preserving allowed formatting tags,
  * this doesn't encode/decode HTML entities.
  * allowed tags : ['strong', 'b', 'em', 'i', 'u', 'br', 'a']
- * allowedAttributes : ['href', '_target']
  */
 export const sanitize = (value) => {
     if (!value)
         return value || '';
+    if (!parser)
+        parser = Parser();
     const decode = (value) => value
         .replace(/&/g, '&')
         .replace(/"/g, '"')
@@ -166,12 +168,78 @@ export const sanitize = (value) => {
     while (decodedValue.match(/&|"|<|>|'|'|&/)) {
         decodedValue = decode(decodedValue);
     }
-    const sanitized = sanitizeHtml(decodedValue, {
-        allowedTags: ['strong', 'b', 'em', 'i', 'u', 'br', 'a'],
-        allowedAttributes: {
-            a: ['href', '_target']
-        },
-        disallowedTagsMode: 'discard'
-    });
+    const { root } = parser.parseFromString(decodedValue);
+    const allowedTags = new Set(['strong', 'b', 'em', 'i', 'u', 'br', 'a']);
+    const dangerousTags = new Set(['script', 'style', 'iframe', 'object', 'embed', 'svg']);
+    const eventHandlers = /^on[a-z]+$/i;
+    const dangerousUrls = /^(javascript:|data:text\/html)/i;
+    const processNode = (node) => {
+        if (!node)
+            return '';
+        // Handle text nodes
+        if (node.nodeName === '#text') {
+            return node.nodeValue || '';
+        }
+        // Handle comment nodes - remove them
+        if (node.nodeName === '#comment') {
+            return '';
+        }
+        // Handle element nodes
+        if (node.tagName) {
+            const tagName = node.tagName.toLowerCase();
+            // Remove dangerous tags entirely (including their content)
+            if (dangerousTags.has(tagName)) {
+                return '';
+            }
+            // Process children first
+            const childContent = node.children ? node.children.map(processNode).join('') : '';
+            // If not an allowed tag, return only the child content (strip the tag)
+            if (!allowedTags.has(tagName)) {
+                return childContent;
+            }
+            // For allowed tags, filter attributes
+            const safeAttributes = [];
+            if (node.attributes) {
+                for (const [key, value] of Object.entries(node.attributes)) {
+                    const attrName = key.toLowerCase();
+                    const attrValue = value;
+                    // Remove event handlers
+                    if (eventHandlers.test(attrName)) {
+                        continue;
+                    }
+                    // For 'a' tags, only allow specific attributes
+                    if (tagName === 'a') {
+                        if (attrName === 'href') {
+                            // Remove dangerous URLs
+                            if (dangerousUrls.test(attrValue)) {
+                                continue;
+                            }
+                            safeAttributes.push(`${attrName}="${attrValue}"`);
+                        }
+                        else if (attrName === '_target') {
+                            safeAttributes.push(`${attrName}="${attrValue}"`);
+                        }
+                        // Skip all other attributes for 'a' tags
+                        continue;
+                    }
+                    // For other allowed tags, remove dangerous attributes
+                    if (attrName === 'href' || attrName === 'src') {
+                        if (dangerousUrls.test(attrValue)) {
+                            continue;
+                        }
+                    }
+                }
+            }
+            // Build the tag
+            const attributeString = safeAttributes.length > 0 ? ' ' + safeAttributes.join(' ') : '';
+            // Handle self-closing tags
+            if (tagName === 'br') {
+                return `<${tagName}${attributeString}>`;
+            }
+            return `<${tagName}${attributeString}>${childContent}</${tagName}>`;
+        }
+        return '';
+    };
+    const sanitized = root.children ? root.children.map(processNode).join('') : '';
     return decode(sanitized);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "rimecms",
-	"version": "0.23.9",
+	"version": "0.23.11",
 	"homepage": "https://github.com/bienbiendev/rime",
 	"scripts": {
 		"dev": "vite dev",
@@ -173,6 +173,7 @@
 		"@libsql/client": "^0.15.15",
 		"@lucide/svelte": "^0.540.0",
 		"@playwright/test": "^1.52.0",
+		"@thednp/domparser": "^0.1.6",
 		"@tiptap/core": "3.11.0",
 		"@tiptap/extension-blockquote": "3.11.0",
 		"@tiptap/extension-bold": "^3.11.0",
@@ -213,7 +214,6 @@
 		"polka": "^0.5.2",
 		"qs": "^6.14.0",
 		"runed": "^0.23.4",
-		"sanitize-html": "^2.17.0",
 		"sharp": "^0.34.0",
 		"sortablejs": "^1.15.6",
 		"svelte-sonner": "^1.0.5"