Adding DOM Sanitizer

plugins/talk-plugin-rte/package.json

@@ -7,6 +7,7 @@
   "author": "The Coral Project Team <coral@mozillafoundation.org>",
   "license": "Apache-2.0",
   "dependencies": {
+    "dompurify": "^1.0.3",
     "pell": "^0.7.0"
   }
 }

plugins/talk-plugin-rte/server/config.js

@@ -0,0 +1,6 @@
+const config = {
+  // Super strict rules to make sure users only submit the tags they are allowed
+  dompurify: { ALLOWED_TAGS: ['b', 'i', 'blockquote'] },
+};
+
+module.exports = config;

plugins/talk-plugin-rte/server/hooks.js

@@ -1,25 +1,33 @@
-const { merge } = require('lodash');
+const { merge, get } = require('lodash');
+const DOMPurify = require('dompurify');
+const config = require('./config');
 
 module.exports = {
   RootMutation: {
     createComment: {
       async pre(_, { input }, _context, _info) {
-        input.metadata = merge(
-          {},
-          {
-            htmlBody: input.htmlBody,
-          }
-        );
+        // Let's sanitize the body
+        const dirtyInput = input.htmlBody;
+
+        const cleanInput = DOMPurify.sanitize(dirtyInput, config.dompurify);
+
+        // Adding the clean body to the comment.metadata field
+        input.metadata = merge(get(input, 'metadata'), {
+          htmlBody: cleanInput,
+        });
       },
     },
     editComment: {
       async pre(_, { edit }, _context, _info) {
-        edit.metadata = merge(
-          {},
-          {
-            htmlBody: edit.htmlBody,
-          }
-        );
+        // Let's sanitize the body
+        const dirtyInput = edit.htmlBody;
+
+        const cleanInput = DOMPurify.sanitize(dirtyInput, config.dompurify);
+
+        // Adding the clean body to the comment.metadata field
+        edit.metadata = merge(get(edit, 'metadata'), {
+          htmlBody: cleanInput,
+        });
       },
     },
   },

plugins/talk-plugin-rte/yarn.lock

@@ -2,6 +2,10 @@
 # yarn lockfile v1
 
 
+dompurify@^1.0.3:
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-1.0.3.tgz#3f2f6ecb6ecd27599a506b410ff47d6eb90fd05d"
+
 pell@^0.7.0:
   version "0.7.0"
   resolved "https://registry.yarnpkg.com/pell/-/pell-0.7.0.tgz#46b3fcdfa8dd7e5999f73c550a337ecc80193dcc"