Revert "Properly sanitizes loaded messages in tgui chat"

This reverts commit 4c32a7094a.
This commit is contained in:
S34N
2024-01-14 12:10:10 +00:00
parent d8379a81cc
commit 24afa55922
3 changed files with 60 additions and 119 deletions
+1 -11
View File
@@ -4,7 +4,6 @@
* @license MIT
*/
import DOMPurify from 'dompurify';
import { storage } from 'common/storage';
import {
loadSettings,
@@ -30,9 +29,7 @@ import { MAX_PERSISTED_MESSAGES, MESSAGE_SAVE_INTERVAL } from './constants';
import { createMessage, serializeMessage } from './model';
import { chatRenderer } from './renderer';
import { selectChat, selectCurrentChatPage } from './selectors';
// List of blacklisted tags
const FORBID_TAGS = ['a', 'iframe', 'link', 'video'];
import { logger } from 'tgui/logging';
const saveChatToStorage = async (store) => {
const state = selectChat(store.getState());
@@ -58,13 +55,6 @@ const loadChatFromStorage = async (store) => {
return;
}
if (messages) {
for (let message of messages) {
if (message.html) {
message.html = DOMPurify.sanitize(message.html, {
FORBID_TAGS,
});
}
}
const batch = [
...messages,
createMessage({
-49
View File
@@ -1,49 +0,0 @@
/**
* Uses DOMPurify to purify/sanitise HTML.
*/
import DOMPurify from 'dompurify';
// Default values
let defTag = [
'b',
'br',
'center',
'code',
'div',
'font',
'hr',
'i',
'li',
'menu',
'ol',
'p',
'pre',
'span',
'table',
'td',
'th',
'tr',
'u',
'ul',
];
let defAttr = ['class', 'style'];
/**
* Feed it a string and it should spit out a sanitized version.
*
* @param {string} input
* @param {array} tags
* @param {array} forbidAttr
*/
export const sanitizeText = (input, tags = defTag, forbidAttr = defAttr) => {
// This is VERY important to think first if you NEED
// the tag you put in here. We are pushing all this
// though dangerouslySetInnerHTML and even though
// the default DOMPurify kills javascript, it dosn't
// kill href links or such
return DOMPurify.sanitize(input, {
ALLOWED_TAGS: tags,
FORBID_ATTR: forbidAttr,
});
};
File diff suppressed because one or more lines are too long