[MIRROR] Properly sanitizes loaded messages in tgui chat (#2571)

* Properly sanitizes loaded messages in tgui chat

* aa

Co-authored-by: LemonInTheDark <58055496+LemonInTheDark@users.noreply.github.com>
Co-authored-by: Azarak <azarak10@gmail.com>

tgui/packages/tgui-panel/chat/middleware.js

@@ -4,6 +4,7 @@
  * @license MIT
  */
 
+import DOMPurify from 'dompurify';
 import { storage } from 'common/storage';
 import { loadSettings, updateSettings } from '../settings/actions';
 import { selectSettings } from '../settings/selectors';
@@ -13,6 +14,14 @@ import { createMessage, serializeMessage } from './model';
 import { chatRenderer } from './renderer';
 import { selectChat, selectCurrentChatPage } from './selectors';
 
+// List of blacklisted tags
+const FORBID_TAGS = [
+  'a',
+  'iframe',
+  'link',
+  'video',
+];
+
 const saveChatToStorage = async store => {
   const state = selectChat(store.getState());
   const fromIndex = Math.max(0,
@@ -35,6 +44,13 @@ const loadChatFromStorage = async store => {
     return;
   }
   if (messages) {
+    for (let message of messages) {
+      if (message.html) {
+        message.html = DOMPurify.sanitize(message.html, {
+          FORBID_TAGS,
+        });
+      }
+    }
     const batch = [
       ...messages,
       createMessage({

tgui/packages/tgui-panel/package.json

@@ -4,6 +4,7 @@
   "version": "4.2.0",
   "dependencies": {
     "common": "workspace:*",
+    "dompurify": "^2.0.12",
     "inferno": "^7.4.2",
     "tgui": "workspace:*",
     "tgui-dev-server": "workspace:*",

tgui/packages/tgui/sanitize.js

@@ -6,10 +6,26 @@ import DOMPurify from 'dompurify';
 
 // Default values
 let defTag = [
-  'br', 'code', 'li', 'p', 'pre',
-  'span', 'table', 'td', 'tr', 'i',
-  'th', 'ul', 'ol', 'menu', 'font', 'b',
-  'center', 'table', 'tr', 'th', 'hr',
+  'b',
+  'br',
+  'center',
+  'code',
+  'div',
+  'font',
+  'hr',
+  'i',
+  'li',
+  'menu',
+  'ol',
+  'p',
+  'pre',
+  'span',
+  'table',
+  'td',
+  'th',
+  'tr',
+  'u',
+  'ul',
 ];
 let defAttr = ['class', 'style'];
 

tgui/yarn.lock

@@ -8233,6 +8233,7 @@ fsevents@~2.1.2:
   resolution: "tgui-panel@workspace:packages/tgui-panel"
   dependencies:
     common: "workspace:*"
+    dompurify: ^2.0.12
     inferno: ^7.4.2
     tgui: "workspace:*"
     tgui-dev-server: "workspace:*"