mirror of
https://github.com/zadam/trilium.git
synced 2025-10-31 02:16:05 +01:00
30 lines
1.0 KiB
JavaScript
30 lines
1.0 KiB
JavaScript
|
const sanitizeHtml = require('sanitize-html');
|
||
|
|
|
||
|
|
// intended mainly as protection against XSS via import
|
||
|
|
// secondarily it (partly) protects against "CSS takeover"
|
||
|
|
function sanitize(dirtyHtml) {
|
||
|
|
return sanitizeHtml(dirtyHtml, {
|
||
|
|
allowedTags: [
|
||
|
|
// h1 is removed since that should be note's title
|
||
|
|
'h2', 'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
|
||
|
|
'li', 'b', 'i', 'strong', 'em', 'strike', 'abbr', 'code', 'hr', 'br', 'div',
|
||
|
|
'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'section', 'figure', 'span',
|
||
|
|
'label', 'input'
|
||
|
|
],
|
||
|
|
allowedAttributes: {
|
||
|
|
'a': [ 'href', 'class' ],
|
||
|
|
'img': [ 'src' ],
|
||
|
|
'section': [ 'class', 'data-note-id' ],
|
||
|
|
'figure': [ 'class' ],
|
||
|
|
'span': [ 'class', 'style' ],
|
||
|
|
'label': [ 'class' ],
|
||
|
|
'input': [ 'class', 'type', 'disabled' ],
|
||
|
|
'code': [ 'class' ]
|
||
|
|
}
|
||
|
|
});
|
||
|
|
}
|
||
|
|
|
||
|
|
module.exports = {
|
||
|
|
sanitize
|
||
|
|
};
|