fix: sre vulnerability issue fixed

Author: reeshika-h

src/helper/sanitize.ts

@@ -0,0 +1,18 @@
+
+type AllowedTags = 'p' | 'a' | 'strong' | 'em' | 'ul' | 'ol' | 'li';
+type AllowedAttributes = 'href' | 'title' | 'target' | 'alt' | 'src';
+
+export function sanitizeHTML(input: string, allowedTags: AllowedTags[] = ['p', 'a', 'strong', 'em', 'ul', 'ol', 'li'], allowedAttributes: AllowedAttributes[] = ['href', 'title', 'target']): string {
+    // Regular expression to find and remove all HTML tags except the allowed ones
+    const sanitized = input.replace(/<\/?([a-z][a-z0-9]*)\b[^>]*>?/gi, (match, tag) => {
+        return allowedTags.includes(tag.toLowerCase()) ? match : '';
+    });
+
+    // Regular expression to remove all attributes except the allowed ones
+    const cleaned = sanitized.replace(/\s([a-z:]+)=['"][^'"]*['"]/gi, (match, attribute) => {
+        return allowedAttributes.includes(attribute.toLowerCase()) ? match : '';
+    });
+
+    return cleaned;
+}
+

src/options/default-node-options.ts

@@ -2,6 +2,7 @@ import { Next, RenderOption } from ".";
 import MarkType from "../nodes/mark-type";
 import Node from "../nodes/node";
 import NodeType from "../nodes/node-type";
+import { sanitizeHTML } from "../helper/sanitize";
 
 export const defaultNodeOption: RenderOption = {
     [NodeType.DOCUMENT]:(node: Node) => {
@@ -11,16 +12,19 @@ export const defaultNodeOption: RenderOption = {
         return `<p${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``}>${next(node.children)}</p>`
     },
     [NodeType.LINK]:(node: Node, next: Next) => {
+        const sanitizedHref = sanitizeHTML(node.attrs.href || node.attrs.url);
         if (node.attrs.target) {
-            return `<a${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} href="${node.attrs.href || node.attrs.url}" target="${node.attrs.target}">${next(node.children)}</a>`
+            return `<a${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} href="${sanitizedHref}" target="${node.attrs.target}">${next(node.children)}</a>`
         }
-        return `<a${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} href="${node.attrs.href || node.attrs.url}">${next(node.children)}</a>`
+        return `<a${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} href="${sanitizedHref}">${next(node.children)}</a>`
     },
     [NodeType.IMAGE]:(node: Node, next: Next) => {
-        return `<img${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${node.attrs.src || node.attrs.url}" />${next(node.children)}`
+        const sanitizedSrc = sanitizeHTML(node.attrs.src || node.attrs.url);
+        return `<img${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${sanitizedSrc}" />${next(node.children)}`
     },
     [NodeType.EMBED]:(node: Node, next: Next) => {
-        return `<iframe${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${node.attrs.src || node.attrs.url}">${next(node.children)}</iframe>`
+        const sanitizedSrc = sanitizeHTML(node.attrs.src || node.attrs.url);
+        return `<iframe${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``} src="${sanitizedSrc}">${next(node.children)}</iframe>`
     },
     [NodeType.HEADING_1]:(node: Node, next: Next) => {
         return `<h1${node.attrs.style ? ` style="${node.attrs.style}"` : ``}${node.attrs['class-name'] ? ` class="${node.attrs['class-name']}"` : ``}${node.attrs.id ? ` id="${node.attrs.id}"` : ``}>${next(node.children)}</h1>`

src/options/default-options.ts

@@ -3,13 +3,32 @@ import { RenderOption } from '.';
 import { Metadata } from '../Models/metadata-model';
 import { EmbeddedItem } from '../Models/embedded-object';
 import { EntryNode } from '../Models/json-rte-model';
+import { sanitizeHTML } from '../helper/sanitize'
 
 export const defaultOptions: RenderOption = {
-  [StyleType.BLOCK]: (item: EmbeddedItem | EntryNode) =>
-    `<div><p>${item.title || item.uid}</p><p>Content type: <span>${item._content_type_uid || (item.system ? item.system.content_type_uid : '')}</span></p></div>`,
-  [StyleType.INLINE]: (item: EmbeddedItem | EntryNode) => `<span>${item.title || item.uid}</span>`,
-  [StyleType.LINK]: (item: EmbeddedItem | EntryNode, metadata: Metadata) => `<a href="${item.url}">${metadata.text || item.title || item.uid || (item.system ? item.system.uid : '')}</a>`,
-  [StyleType.DISPLAY]: (item: EmbeddedItem | EntryNode, metadata: Metadata) => `<img src="${item.url}" alt="${metadata.attributes.alt || item.title || item.filename || item.uid
-    || (item.system ? item.system.uid : '')}" />`,
-  [StyleType.DOWNLOAD]: (item: EmbeddedItem | EntryNode, metadata: Metadata) => `<a href="${item.url}">${metadata.text || item.title || item.uid || (item.system ? item.system.content_type_uid : '')}</a>`,
+  [StyleType.BLOCK]: (item: EmbeddedItem | EntryNode) => {
+    const title = sanitizeHTML(item.title || item.uid);
+    const content_type_uid = sanitizeHTML(item._content_type_uid || (item.system ? item.system.content_type_uid : ''));
+    return `<div><p>${title}</p><p>Content type: <span>${content_type_uid}</span></p></div>`;
+  },
+  [StyleType.INLINE]: (item: EmbeddedItem | EntryNode) => {
+    const title = sanitizeHTML(item.title || item.uid);
+    return `<span>${title}</span>`;
+  },
+  [StyleType.LINK]: (item: EmbeddedItem | EntryNode, metadata: Metadata) => {
+    const url = sanitizeHTML(item.url || 'undefined');
+    const text = sanitizeHTML(metadata.text || item.title || item.uid || (item.system ? item.system.uid : ''));
+    return `<a href="${url}">${text}</a>`;
+  },
+  [StyleType.DISPLAY]: (item: EmbeddedItem | EntryNode, metadata: Metadata) => {
+    const url = sanitizeHTML(item.url || 'undefined');
+    const alt = sanitizeHTML(metadata.attributes.alt || item.title || item.filename || item.uid
+      || (item.system ? item.system.uid : ''));
+    return `<img src="${url}" alt="${alt}" />`;
+  },
+  [StyleType.DOWNLOAD]: (item: EmbeddedItem | EntryNode, metadata: Metadata) => {
+    const href = sanitizeHTML(item.url || 'undefined');
+    const text = sanitizeHTML(metadata.text || item.title || item.uid || (item.system ? item.system.content_type_uid : ''));
+    return `<a href="${href}">${text}</a>`;
+  },
 };