Merge pull request #56 from contentstack/fix/cs-43093-vulnerable-functions

Fix/cs 43093 vulnerable functions

Author: reeshika-h

package-lock.json

@@ -39,6 +39,7 @@
     "@babel/preset-env": "^7.22.20",
     "@commitlint/cli": "^17.7.1",
     "@commitlint/config-conventional": "^17.7.0",
+    "@types/dompurify": "^3.0.5",
     "@types/jest": "^26.0.24",
     "babel-core": "^4.7.16",
     "babel-jest": "^29.7.0",
@@ -48,8 +49,8 @@
     "eslint": "^8.50.0",
     "husky": "^8.0.3",
     "jest": "^29.7.0",
-    "jest-environment-jsdom": "^29.7.0",
     "jest-coverage-badges": "^1.1.2",
+    "jest-environment-jsdom": "^29.7.0",
     "jest-html-reporters": "^2.1.7",
     "jest-junit": "^15.0.0",
     "jsdom": "^21.1.2",
@@ -80,5 +81,9 @@
     "presets": [
       "es2015"
     ]
+  },
+  "dependencies": {
+    "cheerio": "^1.0.0-rc.12",
+    "dompurify": "^3.1.1"
   }
 }

package.json

@@ -1,11 +1,27 @@
-const FigureTagRegex = /<\s*figure[^>]*>([^]*?)<\s*\/\s*figure>/g;
-
 export function containsFigureTag(content: string): boolean {
-  return countFigureTags(content) > 0;
+  const openingTag = '<figure';
+  const closingTag = '</figure>';
+  const openingIndex = content.indexOf(openingTag);
+  const closingIndex = content.indexOf(closingTag);
+  return openingIndex !== -1 && closingIndex !== -1 && closingIndex > openingIndex;
 }
 
-export function matchFigureTag(content: string): RegExpMatchArray {
-  return content.match(FigureTagRegex);
+export function matchFigureTag(content: string): string[] | null {
+  const matches: string[] = [];
+  const openingTag = '<figure';
+  const closingTag = '</figure>';
+  let startIndex = 0;
+  while ((startIndex = content.indexOf(openingTag, startIndex)) !== -1) {
+    const endIndex = content.indexOf(closingTag, startIndex);
+    if (endIndex !== -1 && endIndex > startIndex) {
+      matches.push(content.substring(startIndex, endIndex + closingTag.length));
+      startIndex = endIndex + closingTag.length; 
+    } else {
+      console.error('Malformed figure tag found in content');
+      break;
+    }
+  }
+  return matches.length > 0 ? matches : null;
 }
 
 export function countFigureTags(content: string): number {

src/helper/regex-match.ts

@@ -2,6 +2,7 @@ import { Next, RenderOption } from ".";
 import MarkType from "../nodes/mark-type";
 import Node from "../nodes/node";
 import NodeType from "../nodes/node-type";
+import * as DOMPurify from 'dompurify';
 
 export const defaultNodeOption: RenderOption = {
     [NodeType.DOCUMENT]:(node: Node) => {
@@ -11,16 +12,19 @@ export const defaultNodeOption: RenderOption = {
         return `<p${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``}>${next(node.children)}</p>`
     },
     [NodeType.LINK]:(node: Node, next: Next) => {
+        const sanitizedHref = DOMPurify.sanitize(node.attrs.href || node.attrs.url);
         if (node.attrs.target) {
-            return `<a${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} href="${node.attrs.href || node.attrs.url}" target="${node.attrs.target}">${next(node.children)}</a>`   
+            return `<a${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} href="${sanitizedHref}" target="${node.attrs.target}">${next(node.children)}</a>`   
         }
-         return `<a${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} href="${node.attrs.href || node.attrs.url}">${next(node.children)}</a>`
+         return `<a${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} href="${sanitizedHref}">${next(node.children)}</a>`
     },
     [NodeType.IMAGE]:(node: Node, next: Next) => {
-        return `<img${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${node.attrs.src || node.attrs.url}" />${next(node.children)}`
+        const sanitizedSrc = DOMPurify.sanitize(node.attrs.src || node.attrs.url);
+        return `<img${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${sanitizedSrc}" />${next(node.children)}`
     },
     [NodeType.EMBED]:(node: Node, next: Next) => {
-        return `<iframe${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${node.attrs.src || node.attrs.url}">${next(node.children)}</iframe>`
+        const sanitizedSrc = DOMPurify.sanitize(node.attrs.src || node.attrs.url);
+        return `<iframe${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${sanitizedSrc}">${next(node.children)}</iframe>`
     },
     [NodeType.HEADING_1]:(node: Node, next: Next) => {
         return `<h1${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``}>${next(node.children)}</h1>`
@@ -84,8 +88,9 @@ export const defaultNodeOption: RenderOption = {
     },
 
     ['reference']:(node: Node, next: Next) => {
+        const sanitizedAsset = DOMPurify.sanitize(node.attrs['asset-link']);
         if (node.attrs.type === 'asset') {
-            return `<img${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${node.attrs['asset-link']}" />`
+            return `<img${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs.class ? ` class="${node.attrs.class}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${sanitizedAsset}" />`
         }
         return ``
     },