[MIRROR] HTML formatting on communication consoles, HTML sanitization (#1591)

* HTML formatting on communication consoles, HTML sanitization

* 5

Co-authored-by: prodirus <44090982+prodirus@users.noreply.github.com>
Co-authored-by: Gandalf <jzo123@hotmail.com>

tgui/packages/tgui/interfaces/CommunicationsConsole.js

@@ -3,6 +3,7 @@ import { capitalize } from "common/string";
 import { useBackend, useLocalState } from "../backend";
 import { Box, Button, Flex, Input, Modal, Section, Table, TextArea } from "../components";
 import { Window } from "../layouts";
+import { sanitizeText } from "../sanitize";
 
 const STATE_BUYING_SHUTTLE = "buying_shuttle";
 const STATE_CHANGING_STATUS = "changing_status";
@@ -609,6 +610,10 @@ const PageMessages = (props, context) => {
       );
     }
 
+    const textHtml = {
+      __html: sanitizeText(message.content),
+    };
+
     messageElements.push((
       <Section
         title={message.title}
@@ -623,7 +628,8 @@ const PageMessages = (props, context) => {
             })}
           />
         )}>
-        <Box>{message.content}</Box>
+        <Box
+          dangerouslySetInnerHTML={textHtml} />
 
         {answers}
       </Section>

tgui/packages/tgui/sanitize.js

@@ -0,0 +1,33 @@
+/**
+ * Uses DOMPurify to purify/sanitise HTML.
+ */
+
+import DOMPurify from 'dompurify';
+
+// Default values
+let defTag = [
+  'br', 'code', 'li', 'p', 'pre',
+  'span', 'table', 'td', 'tr', 'i',
+  'th', 'ul', 'ol', 'menu', 'font', 'b',
+  'center', 'table', 'tr', 'th', 'hr',
+];
+let defAttr = ['class', 'style'];
+
+/**
+ * Feed it a string and it should spit out a sanitized version.
+ *
+ * @param {string} input
+ * @param {array} tags
+ * @param {array} forbidAttr
+ */
+export const sanitizeText = (input, tags = defTag, forbidAttr = defAttr) => {
+  // This is VERY important to think first if you NEED
+  // the tag you put in here.  We are pushing all this
+  // though dangerouslySetInnerHTML and even though
+  // the default DOMPurify kills javascript, it dosn't
+  // kill href links or such
+  return DOMPurify.sanitize(input, {
+    ALLOWED_TAGS: tags,
+    FORBID_ATTR: forbidAttr,
+  });
+};