mirror of
https://github.com/ParadiseSS13/Paradise.git
synced 2026-07-20 03:25:49 +01:00
Revert "Properly sanitizes loaded messages in tgui chat"
This reverts commit 4c32a7094a.
This commit is contained in:
@@ -4,7 +4,6 @@
|
||||
* @license MIT
|
||||
*/
|
||||
|
||||
import DOMPurify from 'dompurify';
|
||||
import { storage } from 'common/storage';
|
||||
import {
|
||||
loadSettings,
|
||||
@@ -30,9 +29,7 @@ import { MAX_PERSISTED_MESSAGES, MESSAGE_SAVE_INTERVAL } from './constants';
|
||||
import { createMessage, serializeMessage } from './model';
|
||||
import { chatRenderer } from './renderer';
|
||||
import { selectChat, selectCurrentChatPage } from './selectors';
|
||||
|
||||
// List of blacklisted tags
|
||||
const FORBID_TAGS = ['a', 'iframe', 'link', 'video'];
|
||||
import { logger } from 'tgui/logging';
|
||||
|
||||
const saveChatToStorage = async (store) => {
|
||||
const state = selectChat(store.getState());
|
||||
@@ -58,13 +55,6 @@ const loadChatFromStorage = async (store) => {
|
||||
return;
|
||||
}
|
||||
if (messages) {
|
||||
for (let message of messages) {
|
||||
if (message.html) {
|
||||
message.html = DOMPurify.sanitize(message.html, {
|
||||
FORBID_TAGS,
|
||||
});
|
||||
}
|
||||
}
|
||||
const batch = [
|
||||
...messages,
|
||||
createMessage({
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
/**
|
||||
* Uses DOMPurify to purify/sanitise HTML.
|
||||
*/
|
||||
|
||||
import DOMPurify from 'dompurify';
|
||||
|
||||
// Default values
|
||||
let defTag = [
|
||||
'b',
|
||||
'br',
|
||||
'center',
|
||||
'code',
|
||||
'div',
|
||||
'font',
|
||||
'hr',
|
||||
'i',
|
||||
'li',
|
||||
'menu',
|
||||
'ol',
|
||||
'p',
|
||||
'pre',
|
||||
'span',
|
||||
'table',
|
||||
'td',
|
||||
'th',
|
||||
'tr',
|
||||
'u',
|
||||
'ul',
|
||||
];
|
||||
let defAttr = ['class', 'style'];
|
||||
|
||||
/**
|
||||
* Feed it a string and it should spit out a sanitized version.
|
||||
*
|
||||
* @param {string} input
|
||||
* @param {array} tags
|
||||
* @param {array} forbidAttr
|
||||
*/
|
||||
export const sanitizeText = (input, tags = defTag, forbidAttr = defAttr) => {
|
||||
// This is VERY important to think first if you NEED
|
||||
// the tag you put in here. We are pushing all this
|
||||
// though dangerouslySetInnerHTML and even though
|
||||
// the default DOMPurify kills javascript, it dosn't
|
||||
// kill href links or such
|
||||
return DOMPurify.sanitize(input, {
|
||||
ALLOWED_TAGS: tags,
|
||||
FORBID_ATTR: forbidAttr,
|
||||
});
|
||||
};
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user